059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Size 492KB
Sample260415-w28staay2y
SHA256 059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41
MD5 01eb18ad3dfb5ff1ce56933f199dc873
SHA1 efdbaa0b75a5c7c748a4d0f178ffca2ec0efaca1
SHA512 ee91091590c4ee0ffc872d27687f982e855c792c9e597c51bb39f796ab1dea6eb80b4b7f655a7334ffc0b9965a3595d1672bead555d020a01c8e624f4361c69f
SSDEEP 768:QdnQeQ1RkW0NmgA0WwCKnLo8SivnpUmpRRArK0hW:6nQp1uDNmgAACKPvp9uW
TLSH
T16CB41A53E35A53FDC82BD03492A66633F5B1BD0921757A279BC0CF321E15E50973BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe\""	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5080	cmd.exe
5884	netsh.exe
1868	cmd.exe
5728	netsh.exe
1008	cmd.exe
2176	netsh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
896	schtasks.exe
6004	schtasks.exe
72	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4776	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
4776	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
4632	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
4632	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
5676	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
5676	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5080	4776	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	81
PID 5080 wrote to memory of 5884	5080	cmd.exe	83
PID 4776 wrote to memory of 896	4776	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	84
PID 4632 wrote to memory of 1868	4632	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	91
PID 1868 wrote to memory of 5728	1868	cmd.exe	93
PID 5676 wrote to memory of 1008	5676	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	94
PID 1008 wrote to memory of 2176	1008	cmd.exe	96
PID 5676 wrote to memory of 6004	5676	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	97
PID 4632 wrote to memory of 72	4632	2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5884
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:896

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5728
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:72

C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\system32\cmd.exe
  cmd.exe /c "netsh wlan show profiles 2>nul"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2176
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "UserTelemetryCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

malicious.docm

Path C:\Users\Admin\AppData\Local\Temp\malicious.docm
Size 48B
SHA256 e66b3f2879f8e22d524cb87dc3555020ec7365267ffe92abf61c5df4a8115945
MD5 dd4478b9471bdbdc550130a2b40785b4
SHA1 aaa907a01720bc07e5c5fb13810789e44e2a7b1f
SHA512 84a4814d22cff0cd223fd33c7d4901d82ae5360fc3b2d1e5c30743d11ba8260cf4845988b4944d71df5a687cfb12b6358fbd05241aab91aabc814933a3e6ed6d
MD5 SHA1 SHA512

Submit Download

malicious.hta

Path C:\Users\Admin\AppData\Local\Temp\malicious.hta
Size 397B
SHA256 3006b38c8b669a5ff3d86282ca4ecec2e476b44cd54a22040901bd5cbff09d19
MD5 6e462708c3e71fd7af37a20c47408b8c
SHA1 791de9a38e867c5be8c4a9fab573bc2e04250e5d
SHA512 2d96f2513f38eeedf9b7d2e2d3dd8fffb53f607e0b1d71dfe231c8d912ea08ded5c62c741e083b3b48dc83b0dcfd9e78664cfa0a756174b49d2c82902ce92423
TLSH
T1B9E061681D25E856633575CD54F1FD4E51C3C1F165C2DF040944D56F6440971DF4CBE5
MD5 SHA1 SHA512 TLSH

Submit Download

malicious.lnk

Path C:\Users\Admin\AppData\Local\Temp\malicious.lnk
Size 1KB
SHA256 4d9954ecd4d82f50d5b2857b426d91f120b2a9af1559f5567931d918cce06412
MD5 44c1cb5b9265e960bd856777830fb91d
SHA1 cf438b73180c3a573335dfe11c9af11bf9276cc1
SHA512 e09457934e087b38352506f04610d1743032972c904c40d133b1813b7b6484d838119b9b3f246a03566876fde2ee451d869e815ad3bdf4f8f863122dfe21d5e9
TLSH
T1CF21D0295AC62B32E2F9C23598EA5A87A960F94273019E0D40A173488D12A43B889F1F
MD5 SHA1 SHA512 TLSH

Submit Download

malicious.lnk

Path C:\Users\Admin\AppData\Local\Temp\malicious.lnk
Size 1KB
SHA256 3df6813f55b6c3dfeb8c856b2b663cc8e6a400196968a22b0f13c435c629c8a4
MD5 831bccb0d5f28a26cee8f3e3730d9e29
SHA1 6778bf7f115c3121225b9fa4ce744605c25689a9
SHA512 55632d3b247e70cf8c312e41d2605c42c991969e867f30b03e601920919028476b3646bf31347b692b31a57f75a74c9895e2f7715dc5086033187f55f538e7ca
TLSH
T18921D0394AC62B32E2F9C23598EA5B87E961F94273019E0D40A163488D12E43B889E1F
MD5 SHA1 SHA512 TLSH

Submit Download

malicious.pdf

Path C:\Users\Admin\AppData\Local\Temp\malicious.pdf
Size 238B
SHA256 65e6c4bea22e3759b884d268dd5d18b69e5dcefe3ad0249008489251fea2345f
MD5 4f74a961abd0b2fad087830641ce2e90
SHA1 68b07b2c11dd117ce37a8f26ac109c7084708437
SHA512 f553076806532475f37622d754c1ccc1513c85d8743d48f8a2d6b212d564d8613c4ee7d08814ccf7938eec67f687f37f65745550bafbb8a6219740a42baf31bf
TLSH
T175D0A759746C2C48ED42CCC645673C9A505A742A95CE26D2529CA711A80A039F246BE9
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Size 492KB
SHA256 30112d71914d9b2bd35f70f5925b3027cac86a1d3bf39c1bd00cab72726bf67e
MD5 702aa5455e74f84c3d0204e080990103
SHA1 76c1cd00823070cc3bbc8c13bb39a0c57a07d7b0
SHA512 ad598a2f16a5ca3fd3b8f588721e2d98e3800e446f320dae0aaec725777f33368d54b50acc0c0f9c65ea8bfad6ec69633af5aca7200381f354524dc4636e2e93
SSDEEP 192:pQhb6ltKE75fnanap/pRSRLfjwk1zg6f4Gyfy19n5729a/UkoCsz:p7tKg7p/pRSVfTyfy19nt2a8koCW
TLSH
T1F6B4D6FB239C1BEEE65241B5A061170EF7D6C69347C5AA10A2C48A55CE18440CB7F7DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-04-15_01eb18ad3dfb5ff1ce56933f199dc873_conti.exe
Size 492KB
SHA256 059a6c5f4952382dc89510794cb97558670f30617cb4266344b6d83baae6ba41
MD5 01eb18ad3dfb5ff1ce56933f199dc873
SHA1 efdbaa0b75a5c7c748a4d0f178ffca2ec0efaca1
SHA512 ee91091590c4ee0ffc872d27687f982e855c792c9e597c51bb39f796ab1dea6eb80b4b7f655a7334ffc0b9965a3595d1672bead555d020a01c8e624f4361c69f
SSDEEP 768:QdnQeQ1RkW0NmgA0WwCKnLo8SivnpUmpRRArK0hW:6nQp1uDNmgAACKPvp9uW
TLSH
T16CB41A53E35A53FDC82BD03492A66633F5B1BD0921757A279BC0CF321E15E50973BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_creds_0012.json

Path C:\Users\Admin\Desktop\stealer_out\browser_creds_0012.json
Size 53KB
SHA256 bb6c19602c101307dbb65069c7ec6ebd106c1909886209b2b8e24b2905f935de
MD5 a84fc4a1f9662c3bc04ff57ac4d92a03
SHA1 1a1ae0c10672afdced68f55708c6f3643290b6f8
SHA512 3cd02f1f7d8e620db8389bebcdc3912410f7cf4d3370c5a039352d2d921e9a6a582af923e6455ea41d88c6b2715e00a77b9bd8fd011cb970acede36d3573476c
SSDEEP 96:2sqVQ7CKXOnZfgDMMl3BsHehgTDPxUFZI/hCfh6hZOOQ05rpywVu:ya7tcURDsHjDSeZwkZPQurpTVu
TLSH
T14933B6B6C3703D76E6FB8501AE3E22B61C187C574822A18B7B0E389A1665FD1727C45D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_creds_0013.json

Path C:\Users\Admin\Desktop\stealer_out\browser_creds_0013.json
Size 384KB
SHA256 511f491d9d9a69d83534b59c71046d356c8ca4c103a1590fbbec945f8da418c6
MD5 bb5beca340e0fff1e840ec6b1b2a6ff0
SHA1 ed5a1e51db459b38bafee5f4f60f3c66b60e7ffb
SHA512 fe9194278317c3e6c26a1b36a47b6f9ad88639989525fbe9ddaa306d67a7c24182be2e540b3883c6f14dbd2a50ace90f42849feddc2fec081ccd34ca4aef2007
SSDEEP 48:YSecDbdmkV2+MxO+xNe9kZVVPYu09RECMBOkoR/JgsQrRWDzS:/e0bskV3MIKNe9kLFYBECpkYRyr8K
TLSH
T1178462F6A2C774779285C3637E766E374F618D832B03610768A8038AB106E11FACC68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0008.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0008.json
Size 213KB
SHA256 09d5f0a79405a586e5019843080dbdecbe33b7629c2e3adaacfe6e2d155294f9
MD5 745bed72bc5f84ef47e39202cb0d97bc
SHA1 eadb893d7346f19edc7e9e4139bfe8562308828d
SHA512 35575e1c878e9d439be14d5a14e1880ebacb897db9005cbb300ff6d92b4cf00457b5ab7349a90445679062338d7ffddbce66c45f8b3ad3ddb353f990d44f5af0
SSDEEP 384:LvttPzQh9MfnavRLy942Gre1I9To01JxT:htk8iRLy942Gre1I9TRXT
TLSH
T150249471C3B13F64F4FE0C92BF2E31A61E1C38A70CA8A09F3A08289615B4EE7557542D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0009.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0009.json
Size 26KB
SHA256 62ca830cf38c5e9d3867717ea63b9c71cbf08ea6720afc79140b649757f1310f
MD5 186de578a75e7d969bafbee92c45e871
SHA1 f2b65a27b0b6c16eb3f038ea4eeaaf7a346c6c5a
SHA512 24b2288c525eefcfbd152bb3fca7d5ea89585820878519931490d9f1610b408d693e1294ce11c68dd996cf4b49d05b135a79d4d01e79b07b6de4b5e863c717d9
SSDEEP 48:Y4fWi4c62WuwOHOjlwtAcWdSyCo8bUOZS4ECYtXIFXaYEvsY1LcSQ7s:ojBPu7uwAcmSF34OZGCvlwE8g7g
TLSH
T10DC2B37490F96B1F94A04981BF2D94E3BEACE8271EFAB0CB2916140802F9CC312F585C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0010.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0010.json
Size 6.7MB
SHA256 74423b967bec5cc6b862890c9646c5d84e977c8b5c5d9e1055e79180111d101d
MD5 410b325d5f53e3ab0efbc103018cf530
SHA1 ade5147e109e7ed7239cef3cec227ef4a2183703
SHA512 477a6b813286772212172bfa03e54ef54d9c00b3c4407dca2c49ca06e7b3e03e6bb1aec68e22c52448e18d1c248f8b39f6ba010fa18b45b02295c2e65d6e5498
SSDEEP 768:jOnnt5yytNqK0I3+l+TLvtjI0rou3vuEbjylsBm:jgfyytNqK0I3+l+TLvtjI0rou3vKlsBm
TLSH
T1FD66D7FCC7E03E12FDF7598AEE2DA5E01D14346B24187CA67E8C408378E1AC545B65AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_data_0011.json

Path C:\Users\Admin\Desktop\stealer_out\browser_data_0011.json
Size 128KB
SHA256 ce52f2476e6464eff0997392cc647e9b885210a0916ebc08decc6664d90365bb
MD5 a244573de8ff8737ab3317bead6a9847
SHA1 bd84c12ba1cc937f5779dd84e93499bfdb762ec6
SHA512 e52fcbd05c5fe1326db25957976536dc71ce419eee112b279934381e72fbf84ee92bac43949690f343e232a09f390e4222cacd1dbb9da8ea694c598f434143ad
SSDEEP 24:Y6SrQF42JIqjc8hlNX3eykTahyHJQyXzxxRLngeXP6RThS:Y8RVc8hlt399hwayXzxLgQ
TLSH
T125D3A539D2F13F8B58544D60AB7C9BB53C8864AB3427742E600D54C649413EBA1FC0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

delivery_0014.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0014.json
Size 94B
SHA256 6e738f112d495b26ee7013fa1a1cc21a441ccdcb3d47df1ba07c02a08bd210f9
MD5 b74393ff82a4de0953d8b9f08d01cfd1
SHA1 2ab14862536057a9d6e2ace20b5ce0b463199239
SHA512 b1117c8698a6e83fee3516374fad3cda3a934111bb2adc4c9ca20e2322f85578f84e9d364eb511e340da851a665db5bcf4e2073c8ab428dc0fa208572cd3667f
TLSH
T10BB092544179882C0B0649814468580B514A54C3864F1B50E2089A25CE0C480AB09A8B
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0015.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0015.json
Size 91B
SHA256 a73cc9ef4749a5d68cf58103dbab5b9c050034190f933001f8fb3979c11ee8cb
MD5 5f621daac6d808ae8d444e69144e4a57
SHA1 e33f3377aac3330bceedb5ff6316c108e1cd55de
SHA512 4373b6b499d4efc95dd209dd685bcecc512d4bc014020433972a5ac570ec8febacf038dc1fce998d6f64f1908e6bdb2a46a1312c830bfab7a93743fdb80c4619
TLSH
T10DB0125401389C3C0F07058101796C87414B14C7834B1B40F248C928CE2C090FF09B8F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0016.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0016.json
Size 104B
SHA256 b9aa209b512eff42272032ff57db0b48a2ec80f15bee7d2799f8014914273833
MD5 c9da833c12769406c0a5829912f4b2d4
SHA1 b69f9da8260d46723e0ffc610e8860999c976ac3
SHA512 9d331fe90f47ba0d8fc530f981cd73b45f5de7747345e7a0f049f1a98e386530edd3545b223d71ccab09b922704b0ef0419a659716d22da14b8f78d5b6f8c62f
TLSH
T1DBB092019052AB79AF062304C1A9691AC87008C9A1D25B506800C9649E485869B6562F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0017.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0017.json
Size 111B
SHA256 c3646d12cb1a0a9d10f27cbe1021cc6cccda8ffe1f379a9b0f1b43e36869f1ab
MD5 b8e50a0356beb64c1a35cce13e4b635d
SHA1 5424a9a306ca1a898dd66ef14aacbfcc7fe7c790
SHA512 b3a2b0ae3d1a363c4bfde65bec2cfbc59a9304da974d224e658f743df1ac9abdecedfb986699ce781ef5c0176eb25a1fd3838a14b9f162c067e724c9ab6e2095
TLSH
T1E8B092009052EB6C9F1A5504C2A9691AD17000EAB5E21F505848C964EE4A98AABA575F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0018.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0018.json
Size 104B
SHA256 6b3d5e96b904c0ef688d813b42724046b9f6691df31d9e3396540a8b609ffe04
MD5 dc702c621e013ef447e9d3dd9ce61fbc
SHA1 732af42ec54a20be576f61bbf29797e89a67dccd
SHA512 f300f37bf79160e9fadc5586202a87aeb7b99fcb1619a447948ff2ce44b42fb5044d24eff023cac6c6c1d3dd13b5e4c351bf5169a30fa2c0b3a4a9a1468db057
TLSH
T1EEB092019192AF289F021204C1E9A91AC0B001CAA5D66B505800C8689F584869B6662F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0019.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0019.json
Size 104B
SHA256 c55fd6f788de8db77f3ee6685cb0f841b7dcf7cd505d39403be9573adb5660b7
MD5 3cdb09fae6758e020c0768965eacdb87
SHA1 0807eb5e2436069b33096f43ee1a750305802de8
SHA512 0d6b5b0c5e933dc922e24ea74c1cff79c603288ff71166b022f7abc01a6f24976bfcb51a4aedd3342214f05cfbe1e120f91eb5dbb290e058cf5606870f00dd22
TLSH
T119B012029042EF3D9F061108C1BB6D1BC07000CDB1D33F545800CE74DF585859B6961F
MD5 SHA1 SHA512 TLSH

Submit Download

delivery_0020.json

Path C:\Users\Admin\Desktop\stealer_out\delivery_0020.json
Size 72B
SHA256 46bd670cf258493dd62aac08ade4a907b07b53b22d9fa202e1e7220344492f60
MD5 ed6d6ad8780c6dd33640165db2120204
SHA1 3e31b3b23fd62f8291952a37c375b5ba401e99e6
SHA512 0bf72f9b311b2e1d6dacf480a4e3da59bda689be20c2fa4f84911528ff6e17c08acec6a05fef83101db46d456740bac00ca89ec527b57efea8de2cdd6aafdbca
TLSH
T1ADA022000020C80C0F030000C88C0CAC02CC28F3C08B03E2B088E232CF08CC0FFA080F
MD5 SHA1 SHA512 TLSH

Submit Download

files_0003.json

Path C:\Users\Admin\Desktop\stealer_out\files_0003.json
Size 22KB
SHA256 ab2334d9be90e655ce473d2652e292002f65b52f765cda8c213a6937c6fede4c
MD5 dc97ecdb8f2a860a30b2e01a222c87b1
SHA1 577b1c215892d44e09a3e835bfcbf79d0e541ca2
SHA512 b005880d674ab9378b225c0b1a753ee190ac6f7bff49a622ffbb40bcaf21aa737efed93fe0d4802f0858a774d15c03eefe71770a19b6a510c93e356e5fff999d
SSDEEP 384:9eYmhUvxTyVvk6rEWA/O+j8k5HMFscXIMoTqlU+IhJDKdKY/V1lbdMoWkHC:KhUvRy93rEJOGZMhXIqU+e8dKY/VnQf
TLSH
T19EA2D0F10269DEFCFFA26FDAD6102636CDBA444FE11C9205E531EC179948B26999C4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0004.json

Path C:\Users\Admin\Desktop\stealer_out\files_0004.json
Size 19KB
SHA256 4299bff3dd3045dcd7239b913453cce84e3b5bff027da426411b07d6d65a5d54
MD5 40d3b8913076f9b80c86d44a28a1615e
SHA1 ff546f27c0139c883987fc9dd50354bb1ff007bf
SHA512 bb5957e385905973549414501ccede7e89aac18e23f9751827d6dc5c540c2212e2d3828416d652afa8b23375619fdac28c507096b9d668169654ce05a1829a57
SSDEEP 384:+eGQMaoXFiJ3oMoTqlU+iGkLD/jtDAxIOFQRMoqrLr/R0I:jMaoiJYqU+iGkzOkMT31
TLSH
T1ED92C0F11678ECACE2732B95C922417F8DBB28DF9711E9089CA5D40D05DA908E6B8CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0005.json

Path C:\Users\Admin\Desktop\stealer_out\files_0005.json
Size 606KB
SHA256 b15dbcecd53f87c08bbe18f4842e9dec50ca53098b36e3c2992f46ae6b1315d1
MD5 83582c6d603a32c6d9cac157b43a7039
SHA1 12c373babb838b24afc04ac9bc2bd560701709e6
SHA512 262d8d43421f22d577b9dca21da73acf1738685035f68fb3f0212277282ac329db9611dddd5f614fd3234f6f3d838594797b09caa85fae963ace1d06578181d1
SSDEEP 12288:EXELPisKwh9ugaJjH68SmkoK1GqPstWvWI9HRjSk2Q/:DLNKpK1hTvWI9HRjSkR/
TLSH
T11AD423619D78EEAC8A50032F30A73F8491B286D2C5468EC25DF45C0B792A7A36CD6767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_0006.json

Path C:\Users\Admin\Desktop\stealer_out\files_0006.json
Size 13KB
SHA256 cdb11ee10c1242d5131d366e43fb1cbea710250c60d81f64a48081de15e382a0
MD5 78c93344e9effab46e4aedda9e076bf5
SHA1 c16405a77b8587c92e359e7349388bfcc4df4350
SHA512 792b9a1e9b86e84d80e3958e8e38f31a807578721a1d89e98d451c46c67071733adc53575035dff30f6c2e6204d72ecc793f233680881e54cc797a31fb353e56
SSDEEP 192:KoSPMqCpr9a0/kIlFiofiKkrnFrabPOhWFY0lARFJNljFcHbf5Ai0+gl+n:+UzR/kci5Fm4F0lAfJNljeHbfes3
TLSH
T1D8529EF993D26EDE252E119805671678ECBEC19BFF4C60DCBAEA220103FB7165824D35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recon_0002.json

Path C:\Users\Admin\Desktop\stealer_out\recon_0002.json
Size 3KB
SHA256 da72b2450d6d9d74a78963479b3db00af2c88bd003ea74ff20ed0f6729a732aa
MD5 3056f9462b0372d39cf396c245e2052f
SHA1 33ec5ca44ad404622d06e82cb2366a9a13659304
SHA512 7849ed4c0d50fcdd05bef6ae4576a178d695690c9737082923e9c6335fed33a59cd53aca989c848f30361f19cebece9c8b9fd2b9418998bd269f3d5dec17fe89
TLSH
T14981250A5457D969C9E0A1D5A4A24F9B774F42A3E7808FF814C60B6EF00F5BED0AE351
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_0007.json

Path C:\Users\Admin\Desktop\stealer_out\screenshot_0007.json
Size 7.9MB
SHA256 213bd53d4b947bca939b5c48012cd0aae7dd258b5793d6aa088bf5eb7d3c86b7
MD5 a913960e241bb04ed4cd150913fad97d
SHA1 b4fd5a5d4127cba89687dbb9841aa424b87075ab
SHA512 f354f6335559b5bb59ad8939b064dbf7653f0dfcc85b6928bc5208a33be20bd4ee23782f716b3a3057222ec155a3848c95290807986685cb2d14ceae0d3d254f
SSDEEP 24576:1O7bPwwmUPTWdCPG2v623im3tFU7b5IWu9:RUCduh
TLSH
T1CF862FBA51D27ABB1F2D0951F8832A994F5E9CAF59815F3A34B01DF880D5018BF9E43C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysinfo_0001.json

Path C:\Users\Admin\Desktop\stealer_out\sysinfo_0001.json
Size 100B
SHA256 54b615b43e710b5b5799dd7f04a199ed241ba5451f6ff30710f497ea300ab970
MD5 ec1d0c348103e4f31dc8d7b49dedf764
SHA1 e859948b2d398b187a33c41c102abf7190db57f1
SHA512 0cea143e11e2915a1d7b831f11dc4e44de9c5b29c894d3fc2326acb9eca54acad8977ebc3a3463504b88d30f4f3c70a0e3ba8de375de81ceb4544eed97cbb8d1
TLSH
T1DFB0123805271D4531B403C2011AD12F90BCC10320CACC4C49704F04CE90235B60A010
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4632-130-0x0000015046E30000-0x0000015046E8D000-memory.dmp

Download

memory/4632-129-0x00007FF6977C0000-0x00007FF697843000-memory.dmp

Download

memory/4776-25-0x00007FF6977C0000-0x00007FF697843000-memory.dmp

Download

memory/4776-26-0x00000200D10F0000-0x00000200D114D000-memory.dmp

Download

memory/5676-91-0x00007FF6977C0000-0x00007FF697843000-memory.dmp

Download

memory/5676-92-0x00000186C2B70000-0x00000186C2BCD000-memory.dmp

Download