059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Size 492KB
Sample260415-w28staay2y
SHA256 059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41
MD5 01eb18ad3dfb5ff1ce56933f199dc873
SHA1 efdbaa0b75a5c7c748a4d0f178ffca2ec0efaca1
SHA512 ee91091590c4ee0ffc872d27687f982e855c792c9e597c51bb39f796ab1dea6eb80b4b7f655a7334ffc0b9965a3595d1672bead555d020a01c8e624f4361c69f
SSDEEP 768:QdnQeQ1RkW0NmgA0WwCKnLo8SivnpUmpRRArK0hW:6nQp1uDNmgAACKPvp9uW
TLSH
T16CB41A53E35A53FDC82BD03492A66633F5B1BD0921757A279BC0CF321E15E50973BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3768	netsh.exe
4840	cmd.exe
4776	netsh.exe
2780	cmd.exe
2956	netsh.exe
4808	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4684	schtasks.exe
1812	schtasks.exe
5080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4756	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
4756	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
3516	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
3516	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
208	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
208	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 2780	4756	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	86
PID 2780 wrote to memory of 2956	2780	cmd.exe	88
PID 4756 wrote to memory of 4684	4756	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	89
PID 3516 wrote to memory of 4808	3516	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	93
PID 4808 wrote to memory of 3768	4808	cmd.exe	95
PID 3516 wrote to memory of 1812	3516	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	96
PID 208 wrote to memory of 4840	208	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	101
PID 4840 wrote to memory of 4776	4840	cmd.exe	103
PID 208 wrote to memory of 5080	208	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2956
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4684

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3768
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1812

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4776
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

malicious.docm

Path C:\Users\Admin\AppData\Local\Temp\malicious.docm
Size 48B
SHA256 e66b3f2879f8e22d524cb87dc3555020ec7365267ffe92abf61c5df4a8115945
MD5 dd4478b9471bdbdc550130a2b40785b4
SHA1 aaa907a01720bc07e5c5fb13810789e44e2a7b1f
SHA512 84a4814d22cff0cd223fd33c7d4901d82ae5360fc3b2d1e5c30743d11ba8260cf4845988b4944d71df5a687cfb12b6358fbd05241aab91aabc814933a3e6ed6d
MD5 SHA1 SHA512

Submit Download

malicious.hta

Path C:\Users\Admin\AppData\Local\Temp\malicious.hta
Size 397B
SHA256 3006b38c8b669a5ff3d86282ca4ecec2e476b44cd54a22040901bd5cbff09d19
MD5 6e462708c3e71fd7af37a20c47408b8c
SHA1 791de9a38e867c5be8c4a9fab573bc2e04250e5d
SHA512 2d96f2513f38eeedf9b7d2e2d3dd8fffb53f607e0b1d71dfe231c8d912ea08ded5c62c741e083b3b48dc83b0dcfd9e78664cfa0a756174b49d2c82902ce92423
TLSH
T1B9E061681D25E856633575CD54F1FD4E51C3C1F165C2DF040944D56F6440971DF4CBE5
MD5 SHA1 SHA512 TLSH

Submit Download

malicious.lnk

Path C:\Users\Admin\AppData\Local\Temp\malicious.lnk
Size 1KB
SHA256 e89d3f4951c477723dfcafb9116de4d7cc823845ffe751083f2c22e6551dcbd5
MD5 10b3a084d86089897931831df8313b03
SHA1 3290fe3cc37a42e493cf354db0489c00608230aa
SHA512 7d4a22f40cd008f9cbc92e7daad4d42f487097f01d243d1020f48a223888fcbb7bd9eb181f6bac33763f68c526e956afb31ffb75df3b7e3f9486c9977cbbb94e
TLSH
T11721DD181ED56B32E265C0399CEB5357EA11F98A73015F0A007093491D13E436899E4F
MD5 SHA1 SHA512 TLSH

Submit Download

malicious.pdf

Path C:\Users\Admin\AppData\Local\Temp\malicious.pdf
Size 238B
SHA256 65e6c4bea22e3759b884d268dd5d18b69e5dcefe3ad0249008489251fea2345f
MD5 4f74a961abd0b2fad087830641ce2e90
SHA1 68b07b2c11dd117ce37a8f26ac109c7084708437
SHA512 f553076806532475f37622d754c1ccc1513c85d8743d48f8a2d6b212d564d8613c4ee7d08814ccf7938eec67f687f37f65745550bafbb8a6219740a42baf31bf
TLSH
T175D0A759746C2C48ED42CCC645673C9A505A742A95CE26D2529CA711A80A039F246BE9
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Size 492KB
SHA256 059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41
MD5 01eb18ad3dfb5ff1ce56933f199dc873
SHA1 efdbaa0b75a5c7c748a4d0f178ffca2ec0efaca1
SHA512 ee91091590c4ee0ffc872d27687f982e855c792c9e597c51bb39f796ab1dea6eb80b4b7f655a7334ffc0b9965a3595d1672bead555d020a01c8e624f4361c69f
SSDEEP 768:QdnQeQ1RkW0NmgA0WwCKnLo8SivnpUmpRRArK0hW:6nQp1uDNmgAACKPvp9uW
TLSH
T16CB41A53E35A53FDC82BD03492A66633F5B1BD0921757A279BC0CF321E15E50973BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_creds_0022.json

Path C:\Users\Admin\Desktop\stealer_out\browser_creds_0022.json
Size 53KB
SHA256 731419d2546efca8188b1ac32f61d79ec8827cc1a2eb6d672ef51e561890c9c7
MD5 1e93ccc3cbfe2dca22cf6512cc38b573
SHA1 0c2a0eef56e980d8a1782e7bd5b74872976170f5
SHA512 9a52ba8369b835d90c041ff7a14066ab6816b7264267e61faf3250fe8bacb32555c43d4dca27630792bb4df68ae5dfde6b25361684704c3b5a08e027a292a186
SSDEEP 96:n9sqVQ7CKXOnZfgDMMl3BsHehgTDPxUFZI/hCfh6hZOOQ05rpywVu:nVa7tcURDsHjDSeZwkZPQurpTVu
TLSH
T10733C7B6C3703D76E6FB8501AE3E22B61C187C574422A18B7B0E389A1665FD1727C41D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_creds_0023.json

Path C:\Users\Admin\Desktop\stealer_out\browser_creds_0023.json
Size 384KB
SHA256 a909f3d2618f903f892911b373a0b944a6aa44a0506ead43f07bd1bc11627b36
MD5 7370219a3af2850d3db11d245f4a49f8
SHA1 25f893989c6ffb5ca07205195b87bbdc8dd1f5e5
SHA512 2cd28fe2cc8afceb0c2e1dc285a1c56eac5fa8298b657d516da1eb1f0430e5c66e113c4373dde51d6c7d9810add97e9e032315834eae32130622c40eedb2ebbd
SSDEEP 48:YSecDbdmkV2+MxO+xNe9kZVVPYu09REloGwjOkTR/7Dfr8lCeo:/e0bskV3MIKNe9kLFYBEnwakNzrrPD
TLSH
T1D58454F6A2D664B79395D3636E395E374F625D832B03604768E8028DF206A21F6CC7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0018.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0018.json
Size 213KB
SHA256 09d5f0a79405a586e5019843080dbdecbe33b7629c2e3adaacfe6e2d155294f9
MD5 745bed72bc5f84ef47e39202cb0d97bc
SHA1 eadb893d7346f19edc7e9e4139bfe8562308828d
SHA512 35575e1c878e9d439be14d5a14e1880ebacb897db9005cbb300ff6d92b4cf00457b5ab7349a90445679062338d7ffddbce66c45f8b3ad3ddb353f990d44f5af0
SSDEEP 384:LvttPzQh9MfnavRLy942Gre1I9To01JxT:htk8iRLy942Gre1I9TRXT
TLSH
T150249471C3B13F64F4FE0C92BF2E31A61E1C38A70CA8A09F3A08289615B4EE7557542D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0019.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0019.json
Size 26KB
SHA256 00e4a3b4b4e351e54899b8962ce71d116339eb78d1e2059e864737b90bb6d572
MD5 5e0bed247e8afc069f5c48df7b005549
SHA1 aa4d0d70189898cd90c4925cbe04f5aedb6c2f13
SHA512 02e6b0ca1dcdeef42db7f9d33c997a3bc2ebc3555050f3af9f80ed7c1d5cd26b9f611f371af6b8bb9f452ab407302b0b7fff789052a7d15ecbb4097609b01881
SSDEEP 48:Y4fWi4c62WuwOHOjlwtAcWdSyCo8bUOZS4ECYtRtm4WQwFe7s:ojBPu7uwAcmSF34OZGCAm4aeg
TLSH
T1FFC2C974E0F96B5F60648680FFBD99E7BC5CA4331AFEB18F5901540406B599312F544C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0020.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0020.json
Size 6.7MB
SHA256 8a6c9ae8091be6b6b9e2aa0c4d078f47a779ccccbcc45425e4dbf6c90625e6d8
MD5 4299a7be54a4a2ad61012932dc8dba2e
SHA1 ccaeab0e7560b4e57bfbf72cedf06ea3d594390a
SHA512 bb9561d1905e818bc60731051c8af5b35d9620397dc43f66dac054489ee420464f7b4c746595c00559dde79b76a29c7fb438a831a8da10fd28c68a370d3fb50f
SSDEEP 768:j2nnt5yytNqK0I3+l+TLvtjI0rou301tMyl0Bm:jofyytNqK0I3+l+TLvtjI0rou30Rl0Bm
TLSH
T14C66E7FCC7A03F52FDF7595AAE2DA0901D24642764187CD77E8C008378E1BC54676AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0021.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0021.json
Size 128KB
SHA256 9457304ac342c1daf8f2a953e74df2f77e0d04a432f3e6e107cc32c8e335efc8
MD5 a7dae4ddb8faf9d0a74a75b58a64aa02
SHA1 0cb3d91e046c4808cbc1ec57e891f084e66caaaf
SHA512 27a6c32b7ce27dc89c5ec139bea17b4313acc938995863e1e15be758281f9aae189387480ad09331a42cfcc8928185c08c0ce52d7ea738c5ba80bec9e41b1089
SSDEEP 24:Y6SrQF1JIqjc8hlNX3eykTahyHJQyXzxxRLngeXP6RThS:Y81Vc8hlt399hwayXzxLgQ
TLSH
T1DCD3A539C3B13F8B58540D61AB7C9BB53C8864AB3427741D600D54864D013EBA1FC0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delivery_0024.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0024.json
Size 94B
SHA256 6e738f112d495b26ee7013fa1a1cc21a441ccdcb3d47df1ba07c02a08bd210f9
MD5 b74393ff82a4de0953d8b9f08d01cfd1
SHA1 2ab14862536057a9d6e2ace20b5ce0b463199239
SHA512 b1117c8698a6e83fee3516374fad3cda3a934111bb2adc4c9ca20e2322f85578f84e9d364eb511e340da851a665db5bcf4e2073c8ab428dc0fa208572cd3667f
TLSH
T10BB092544179882C0B0649814468580B514A54C3864F1B50E2089A25CE0C480AB09A8B
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0025.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0025.json
Size 91B
SHA256 a73cc9ef4749a5d68cf58103dbab5b9c050034190f933001f8fb3979c11ee8cb
MD5 5f621daac6d808ae8d444e69144e4a57
SHA1 e33f3377aac3330bceedb5ff6316c108e1cd55de
SHA512 4373b6b499d4efc95dd209dd685bcecc512d4bc014020433972a5ac570ec8febacf038dc1fce998d6f64f1908e6bdb2a46a1312c830bfab7a93743fdb80c4619
TLSH
T10DB0125401389C3C0F07058101796C87414B14C7834B1B40F248C928CE2C090FF09B8F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0026.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0026.json
Size 104B
SHA256 b9aa209b512eff42272032ff57db0b48a2ec80f15bee7d2799f8014914273833
MD5 c9da833c12769406c0a5829912f4b2d4
SHA1 b69f9da8260d46723e0ffc610e8860999c976ac3
SHA512 9d331fe90f47ba0d8fc530f981cd73b45f5de7747345e7a0f049f1a98e386530edd3545b223d71ccab09b922704b0ef0419a659716d22da14b8f78d5b6f8c62f
TLSH
T1DBB092019052AB79AF062304C1A9691AC87008C9A1D25B506800C9649E485869B6562F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0027.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0027.json
Size 111B
SHA256 c3646d12cb1a0a9d10f27cbe1021cc6cccda8ffe1f379a9b0f1b43e36869f1ab
MD5 b8e50a0356beb64c1a35cce13e4b635d
SHA1 5424a9a306ca1a898dd66ef14aacbfcc7fe7c790
SHA512 b3a2b0ae3d1a363c4bfde65bec2cfbc59a9304da974d224e658f743df1ac9abdecedfb986699ce781ef5c0176eb25a1fd3838a14b9f162c067e724c9ab6e2095
TLSH
T1E8B092009052EB6C9F1A5504C2A9691AD17000EAB5E21F505848C964EE4A98AABA575F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0028.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0028.json
Size 104B
SHA256 6b3d5e96b904c0ef688d813b42724046b9f6691df31d9e3396540a8b609ffe04
MD5 dc702c621e013ef447e9d3dd9ce61fbc
SHA1 732af42ec54a20be576f61bbf29797e89a67dccd
SHA512 f300f37bf79160e9fadc5586202a87aeb7b99fcb1619a447948ff2ce44b42fb5044d24eff023cac6c6c1d3dd13b5e4c351bf5169a30fa2c0b3a4a9a1468db057
TLSH
T1EEB092019192AF289F021204C1E9A91AC0B001CAA5D66B505800C8689F584869B6662F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0029.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0029.json
Size 104B
SHA256 c55fd6f788de8db77f3ee6685cb0f841b7dcf7cd505d39403be9573adb5660b7
MD5 3cdb09fae6758e020c0768965eacdb87
SHA1 0807eb5e2436069b33096f43ee1a750305802de8
SHA512 0d6b5b0c5e933dc922e24ea74c1cff79c603288ff71166b022f7abc01a6f24976bfcb51a4aedd3342214f05cfbe1e120f91eb5dbb290e058cf5606870f00dd22
TLSH
T119B012029042EF3D9F061108C1BB6D1BC07000CDB1D33F545800CE74DF585859B6961F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0030.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0030.json
Size 72B
SHA256 46bd670cf258493dd62aac08ade4a907b07b53b22d9fa202e1e7220344492f60
MD5 ed6d6ad8780c6dd33640165db2120204
SHA1 3e31b3b23fd62f8291952a37c375b5ba401e99e6
SHA512 0bf72f9b311b2e1d6dacf480a4e3da59bda689be20c2fa4f84911528ff6e17c08acec6a05fef83101db46d456740bac00ca89ec527b57efea8de2cdd6aafdbca
TLSH
T1ADA022000020C80C0F030000C88C0CAC02CC28F3C08B03E2B088E232CF08CC0FFA080F
MD5 SHA1 SHA512 TLSH

Submit Download

files_0003.json

Path C:\Users\Admin\Desktop\stealer_out\files_0003.json
Size 24KB
SHA256 72c4e2571d8803fc1db5a2538f05bc9b19074dce853453a033ed65c35f52c8f3
MD5 83c38551a5440913d1009a76664d1eef
SHA1 ffd1a3e4fcdc8aa14ddf55c291e93bd39a8d580d
SHA512 660fab749aa5cc36f8e16140af7e78ddb973ddfa672c3667fd9f83dad5b152009e350230be22cf909f8cc9413b2b5db03061518cc233f379b41b7efc2f50f8b3
SSDEEP 384:Je+Uhg0tZEfP8YnUC0kcySCSNjWXT+RqgJFAum2Pln0HUu8/kGc+y2Z:SLQP8QtSCSNja+TAum2Nd0Gcc
TLSH
T152B2D13286EE5C5C076E2AC6D386272C0C8F48A7FB90F11DA0527A7F55EF344D91A0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0004.json

Path C:\Users\Admin\Desktop\stealer_out\files_0004.json
Size 24KB
SHA256 41a05a2f47f0f91306da02063c7990f30f8ac1502daf692bc34ad77459be7457
MD5 73bd62db065b607c1d8f54fbd9212bda
SHA1 5215260605a4f21e56e6431fe090f1fe7c7b6abc
SHA512 ff73ec0ce495ae40d460c541555d63e67474830e4774836bcd5a871f67f932b8314cf428695db90484ea96edaa2e96d3d508f41ee887f3143f1bb2b3a377da8d
SSDEEP 384:Ce2y9BuQPzCiIztSody0KlHSXNXicSV47ejhWNWpjvCZDKdKY/36cnq1MA:zsQPzCzABHHSYTGetnBaMdKY/qKqp
TLSH
T18DB2DFF081F7ADE526E11BDE0B3A073FFD82019F6B09DC75AAD1A90789C85185CAC4D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0005.json

Path C:\Users\Admin\Desktop\stealer_out\files_0005.json
Size 545KB
SHA256 56a0869f63e1e4a6b5fa5070206dda8f0942d18b34ba45b4ad74f00b2dc6eee9
MD5 596e82e127b9270b7c65cb05219f52b6
SHA1 8903689a405fad8506bb29437d50227ae7be5d75
SHA512 4a1e8241b3e872860a7f23adc37ad9fe71a83462008ebed94ee4289722c55886d69afa386008bfdf3450de1ce2e84d8220d8146cd73a623d80fb0df837894e1a
SSDEEP 6144:MyBccjFBhwKkQouBRqTE3yAep7XhEDnRT8SE1q3wUNDyr+98wo4zXKnt7+bRSvI0:MZOhwKbQ4replsTFvzvLgEbRKj1pnR
TLSH
T106C423505EE8ECEC058CA01C225BFB1D46E72BE0C255ADF12E311ED6425971C22AAF7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0006.json

Path C:\Users\Admin\Desktop\stealer_out\files_0006.json
Size 288KB
SHA256 776111c296bef54abdca66fac7151a9d0a54c55a7653d17bb08e5afbd6feebc7
MD5 f8330f005515e8bfa47810ee5369a25d
SHA1 da83f76ac9cfb6a784cc590ad97a31e19c8aee71
SHA512 cfba4edaa5073d23331a3e6c01cf88d6e83d8c34a0e16bcef9ae8831efa30607b1afd6ac4ec278efeb5fddaa41566a2d22ba3ff2e422bbc4faa5591e8e99bf3d
SSDEEP 6144:irazVKzqPRaTGHmMS/J7aQAMhDSkHQM7n65+H8M9mlPGGHkOu7:LzVp0TKWlaQlhNhsZGGHkV
TLSH
T1535423F9BB37169B98490E19283FDDCFBC1D88C8D18273D386B414AAF46774541B7A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0007.json

Path C:\Users\Admin\Desktop\stealer_out\files_0007.json
Size 16KB
SHA256 a05a38cd1cb8b4575472de59476e12f94f52a468551d387208319bb2110f9a90
MD5 4f7f94a1bc6ad639dbc0236914c9fa7f
SHA1 420177df9f2e6551bae8fc32e61d5fe8cf5302b2
SHA512 a8538cee95ce712d716c70abdd1e9e8d2d234281f6bf99588461f0b7672c1e1aff35d3d7c349647302e0e2980a0c754165b43e8894c7e68121149f3b67955864
SSDEEP 192:SSPMqCprXXCQ6w78Sjxgi1KHTS/P4vCrabPOhWFY0lARFJawMmrfNNkww6xGWw9a:hUzCQ6vo+iuKm4F0lAfJ9TrOnuxmu
TLSH
T1C372BFB486A4ECF4B41821CB00132594DD5BA1BBD7CA64CC71EF568712F3776CE89D21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0008.json

Path C:\Users\Admin\Desktop\stealer_out\files_0008.json
Size 263KB
SHA256 9bb8d3c4409692407fec73cb8d08c4f2a304b4ac335371fd8c310f3b79a91279
MD5 3f123c9dd5fca417683c5c8f600b3bae
SHA1 eb0c6bf169c0673726713e514b8326a955e7873e
SHA512 9a5e17c4a9365bdf99a33b140936f62c1af04aba255c0e3762134e81d1169dbe416abe0c799673ed6a32c4adea71c37656a27aa861b033b522efae86de734ca9
SSDEEP 6144:tizcj0NIfP4NjEfoQtD+PDOgDpI2t5fFld3eBaAck/:twafAFW2dDpNvlduBL5
TLSH
T166442394D9E249F29F1FFEE87575389D6B710F2E48C912DA078A01C31C1BBEF2926161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0009.json

Path C:\Users\Admin\Desktop\stealer_out\files_0009.json
Size 24KB
SHA256 67b0ed32979e664b43997e93044351abb74d26175ed87b065f7d65f9a50eb290
MD5 6f5c148a3d407adfca0f45811877865a
SHA1 666505186dfe1bfbe7a7a6351dc468b794f09703
SHA512 e99dc81d5cac930ad526f5f7d47cc7d4c77a945fc7f6877fe05f2750dbeb4947097369723d0937f063fe53ab4f7b27d398b9787a5e3fd07246818c577d229766
SSDEEP 384:xeYiEIN2VPw7GjrYmZNkynxM7jCU4+bvMoTqlU+FfU7rm2Pln0HUu8/SUe10U:ZTIN2majrFi3CpYvqU+F+rm2NdCF
TLSH
T1A3B2E0F32712BCCE673600C1C311075ACE9E897F9BA8A1A4A0859E7F82DE651446D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0010.json

Path C:\Users\Admin\Desktop\stealer_out\files_0010.json
Size 619KB
SHA256 b0206aa72adb7e6b626cad4e0e1c96e9f6c90c384121df7cb93641aae624fdb8
MD5 187ccd677a3a2a7c9cd53e08751d42a8
SHA1 84eb85f65324ed3eb50f6b15766dd9a907070b50
SHA512 cef8781455ebe6a664a6c6d56ef34a8810e1ec8210a819c3c4bc965215e887c247d786c3cd1612d60300111fa3becf5dd68ddbb37f58b4942aefb66d2e7f7f09
SSDEEP 12288:wJq2biXOjfctcQn++aWmdr8lcASAUhvMxCFI:wJUXO4tpOglzF
TLSH
T10ED423080E5E4F8679D5D2EDB0BFFF3F3CA641416865D2ACF0AEF80C19446176E165A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0011.json

Path C:\Users\Admin\Desktop\stealer_out\files_0011.json
Size 17KB
SHA256 2512e8a7f30da60c12e1a86e2ce5b74be82001dfe8ef42d0338195a45de55523
MD5 a9f2ebd7326a8b84879b20d931893e91
SHA1 87e3d9f65b745900c76e060089c074fc0762f081
SHA512 23986b31553892e08c9f7dfd68096eacd708aa56f113c0c965ef85c71936bf11daaedabac410cc5fda887489a336e0f2eceb1a007cd4a715219413958a2f9a08
SSDEEP 384:OaUz2kciv8l6dVKbRqh1mtGWCwas+UgL2lkRciJflxN4uwZc:OaoBXKK1moZwafWWxNT1
TLSH
T19582D0B167A22D616F343269E1B7163A5CCC15CFD80407FC74893DDA9866CE0885E5F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0012.json

Path C:\Users\Admin\Desktop\stealer_out\files_0012.json
Size 15KB
SHA256 1bcbfdb4f59a1ace5e2cc501ddb95b4aefc0f9bc08d73502dbf9757d11e1631a
MD5 9096975f358cbf02a97c0804f1c6e0d1
SHA1 f52ac5699f824f4db740990538c2f356b89b3417
SHA512 12ce4fed16bb579e3cb1454cdf2df0c922173b6a74d166ba10f8e8aae400e90446140798d36a0e01a27eb4dff1b62e7f9881e4f8d6b69c500bed394244dca391
SSDEEP 384:aUzxwaPFiSV5J7hm+nNR7oA1gaP1H+8cgK/c:acpNrhVoA1gaU8c4
TLSH
T1BE72B0707333CF4C7760041A00BF573BECB4068FE9496839F1D6A06796E4664BDE691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0013.json

Path C:\Users\Admin\Desktop\stealer_out\files_0013.json
Size 313KB
SHA256 6fc994a0cf1c608412d3cffd373f47c4801bfd46702a5f750c347914676cee19
MD5 bcdb010c494e48c4d7ec8e0d655a36e6
SHA1 b047bf00e993a2a1e6cf2eaea0cd90baeb5728d6
SHA512 53a9a334aa28c9e8275ce854385dc8c5a77b2294d2ff53548bb09aa95f26e4f1bc9c7b0316515799fd9ba9970e2c8088439d2668f2d747692a6cb3aaab84c543
SSDEEP 6144:85H2MrqZ4jHhiybgxUTM5RMJ+r+PF4VCFvTEDao4KK//bDufRVCr:mWMrjh18iWCJO+PFrZlo4ZzDuJA
TLSH
T1BA64234098329FE04711F189325E174F42E28E62E08F65F656FDAF8B61863E24C6FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0014.json

Path C:\Users\Admin\Desktop\stealer_out\files_0014.json
Size 17KB
SHA256 41122ab5370bbe0eed1eb80d4cf80a02512ae6d4e4f25b0e93c5e93ce46faa9b
MD5 69137563823e58d2e318bb2116baa20d
SHA1 3f6db6eb06188c599c49d0072b52a5cb34dcfd9f
SHA512 0298589ece4476fa6df5f2a301314a239c0eaa1ee9e03e2bb1466417ae807d908d3ae28592293e7996158126d3933f418bd62477e40c82381d6996fb60b958a0
SSDEEP 384:Te6SQoYmELMoTqlU+ASlfD/jtDAxIOFQRMoqY1Acijg:eQeELqU+ASl3OkMaAch
TLSH
T1B782AFF12220DC8CE5336BDDC38916BBCD6924DFA7009C5890629A5E05C772AD9D58FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0015.json

Path C:\Users\Admin\Desktop\stealer_out\files_0015.json
Size 18KB
SHA256 cbced8d1b4bfa68f19ef7a7ffa3fdd6d22f6c42247195325f22cb98954208b92
MD5 7df7adeb455ceb74035ef7060765136d
SHA1 1aca229a04b9c690e2f318430cac0a37a6d13f81
SHA512 597ab3cf9bd8f1b184940d4c821957abc80aa599b25c0b77bc24849233d2ab8219b671c84c30d241d14065f56e439dfc197ed9c5bb3a676e46c5389ffb00e9e4
SSDEEP 384:gUzmWkciANY8zUR5J7hm+y2zLp9Wm54weC5BuraYs9BNI:ghoYiURrh3PoweLaYs9vI
TLSH
T12F82C0F2C7BDAD46A52D12638403532D9CF501EF8B4401AEA5879C67F1467A1BF8AE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0016.json

Path C:\Users\Admin\Desktop\stealer_out\files_0016.json
Size 14KB
SHA256 368f62df5978af7912e4e43484d4bff3ac09ca53ac80a47e7244391609856aff
MD5 5bac96ab152b99716c1a7b680061718e
SHA1 ed99ac84a72e2d8e62fd80ed946104c71b5f4f4a
SHA512 38a5bbf969821a5afa98b211de70acd5bfa7a828d415e38bf1e03021d9544838f093b90ab225e328015f0dc3f09b11f5dd136a1e766ea3110e315b4230e15c2c
SSDEEP 192:uSPMqCpr2nI+vnqWn9tAytOk6/ZX+ubtqAJGexFXhTzbChJuNyfYu3v0tDwWiOld:FUzAIfW9SytOB95J7hm+Nluc+cOY
TLSH
T1C762B07216AC4E89B53C488E40239647DD4B428FCF5185ADEFC324B5A691B70BCFB1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recon_0002.json

Path C:\Users\Admin\Desktop\stealer_out\recon_0002.json
Size 3KB
SHA256 00e0f00f1233843a858bd4653d85562ce476f490db53484799f0c03227bc38c2
MD5 78c91c331a88fa19ec85a5e67464967b
SHA1 4aa7b49ff14dcc871ee55b7dce6d27d9bd1c26c6
SHA512 9e6af1403818975fae058e5ddb3388085a92b25ba6df4b99b010ff7bf3d01aaf4a608420cf39afbd1917e2645dabf710efb9928aa457d370b7a3c88ba665c44f
TLSH
T1E881150A5457D969C9E0A1D5A4A24F9B774F42A3E7808FF814C60B6EF00F9BED0AF351
MD5 SHA1 SHA512 TLSH

Submit Download

recon_0002.json

Path C:\Users\Admin\Desktop\stealer_out\recon_0002.json
Size 3KB
SHA256 86da7e073d96d02ac1aca68e7c6448ea94d9860d1748e8f4084471f8babaf883
MD5 392c9e8f8cf19959edfc25ef5dd8db27
SHA1 0db85e43d2050c98b0fca66aa9243adb34d180bc
SHA512 85f9dc7e172a4465a3604bd43324d5b011ef631e61bbfde43f7eba2d0f7c2407526c53d10c962b984d9cc4f235eb7ee98f22a6f152274d8eba9ce1892cfeab6b
TLSH
T13581260A5457D969C9E0A1D5A4A24F9B774F42A3E7808FF814C60B6EF00F9BED0AE351
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_0017.json

Path C:\Users\Admin\Desktop\stealer_out\screenshot_0017.json
Size 7.9MB
SHA256 adcdac39074b9892ca795e3c44e3c3c5dd8c86b1f0998a24a09c833fa78243dd
MD5 db191d5e2a063c969336606360cbba84
SHA1 a297081321d3daa46eb1cbcbebdc273d14378e3f
SHA512 6bce91e5520851a9867d3a5a0ed8d2723611e081410988e0e3c72099a07917215a37fd5f5dd52415b195565e538d243ac2d2419a4e06d0c5da1fd0c70fa9d6c3
SSDEEP 12288:TLWCZmoVBOr96voJlK3MJ45uwl6yY6nB5Ek9g:TLW0VBOJ6ru4696B5Ek+
TLSH
T1AE861FBB5CD2BAAA1F580853FB83EA594F0F9CAB59905E3930803DC580D471B9F5E52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot_0017.json

Path C:\Users\Admin\Desktop\stealer_out\screenshot_0017.json
Size 7.9MB
SHA256 7f6bcdef167af61c3c0c8c5021684f1660f3b2da8bc6a5ab59605484597f148b
MD5 6dd188534ca726bfd25bb392768f8507
SHA1 a1c77a2daa0f6bcb0430639fa5b80180dfb40d30
SHA512 068222cfb664d86c5e59b52dbea697763b9caa7e2b67f289c8c795cf3060a3a8ca03e47f28eaf9e733c1cca8e1b4141ea001b9629254cac93eccf37123bfed46
SSDEEP 12288:TLWe4cncJvxdX0r7bML4LuOzUnQI6Jij1hyHi2vXUV9N3xtc4F8Ts2ytofzMwKbg:TLWb1hyHi2vEVnkR4696W5Ekd
TLSH
T1358612B71EC2BA7A1F690853FB43E9484F0FED5B69605D3A20402CC681D67578F5E2AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo_0001.json

Path C:\Users\Admin\Desktop\stealer_out\sysinfo_0001.json
Size 100B
SHA256 396ba43be25235e16c9ef4f5082df01da87f8693e56930a1ac47871aab346fa0
MD5 3c3b86966be055d94e6c3cb43a8fd118
SHA1 fbb57702952d966df43631c14c55809cce02c775
SHA512 902dad963dbe0698fe1d089a25a355b97459de0043553320ce0d8910e84f095e457fafab67310699a44b39d007b207d49a4b99983387ee0d1c783d493cd0dc39
TLSH
T13EB0123D102D1A1425A452C20517153F40ADD18520DEDC8E9E720F148A7030A6706000
MD5 SHA1 SHA512 TLSH

Submit Download

memory/208-170-0x00007FF70FCA0000-0x00007FF70FD23000-memory.dmp

Download

memory/3516-106-0x00007FF70FCA0000-0x00007FF70FD23000-memory.dmp

Download

memory/4756-35-0x00007FF70FCA0000-0x00007FF70FD23000-memory.dmp

Download