3f83ccbff42e0a18db0ca3edb05de96867f208c09b39ede2d7ce9b295063347b

Analysis

user interaction
yes
max time kernel
42s
max time network
17s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GV.exe
Size 68.2MB
Sample260602-rdbe7agt2l
SHA256 3f83ccbff42e0a18db0ca3edb05de96867f208c09b39ede2d7ce9b295063347b
MD5 9074e7ff7875e4ff396492704d0d8845
SHA1 88f340ba70303aa3f70ef3c18f01b02da51b46b6
SHA512 c14f891626bfc2f2aad1ca7a987ee074c3a6b056b6197644bd8e10f62d89b509ff9ff2078f013306af47617303c4b06d0a9c39ad74b8b8033d117e891a472b3e
SSDEEP 1572864:yjjhepmPXhoXygPqPcDzDiWyK3jk0dn9swasyMIT8MnejOQRWEohm75I:yPhepE2XHzzWe3jku/aP7ej5ohmG
TLSH
T1F6F73332DE9E4933C80898F179945507F9A8EF6F769862232D948065F33C7DC8DC98DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3216	debug.exe
4132	debug.exe
2712	debug.exe
236	debug.exe
1652	debug.exe
3172	debug.exe
2372	debug.exe
2368	debug.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org
3	api.ipify.org

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2372	debug.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
232	powershell.exe
4244	powershell.exe
3020	powershell.exe
2136	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GV.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	debug.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	debug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	debug.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2136	powershell.exe
2136	powershell.exe
232	powershell.exe
232	powershell.exe
4244	powershell.exe
4244	powershell.exe
3020	powershell.exe
3020	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe
Token: 35	2136	powershell.exe
Token: 36	2136	powershell.exe
Token: SeShutdownPrivilege	3216	debug.exe
Token: SeCreatePagefilePrivilege	3216	debug.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe
Token: 35	2136	powershell.exe
Token: 36	2136	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe
Token: SeSystemtimePrivilege	2136	powershell.exe
Token: SeProfSingleProcessPrivilege	2136	powershell.exe
Token: SeIncBasePriorityPrivilege	2136	powershell.exe
Token: SeCreatePagefilePrivilege	2136	powershell.exe
Token: SeBackupPrivilege	2136	powershell.exe
Token: SeRestorePrivilege	2136	powershell.exe
Token: SeShutdownPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeSystemEnvironmentPrivilege	2136	powershell.exe
Token: SeRemoteShutdownPrivilege	2136	powershell.exe
Token: SeUndockPrivilege	2136	powershell.exe
Token: SeManageVolumePrivilege	2136	powershell.exe
Token: 33	2136	powershell.exe
Token: 34	2136	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3216	1656	GV.exe	80
PID 3216 wrote to memory of 4132	3216	debug.exe	81
PID 3216 wrote to memory of 2712	3216	debug.exe	82
PID 3216 wrote to memory of 2136	3216	debug.exe	83
PID 3216 wrote to memory of 232	3216	debug.exe	87
PID 3216 wrote to memory of 236	3216	debug.exe	88
PID 3216 wrote to memory of 1652	3216	debug.exe	90
PID 3216 wrote to memory of 4244	3216	debug.exe	91
PID 3216 wrote to memory of 3020	3216	debug.exe	93
PID 3216 wrote to memory of 3172	3216	debug.exe	95
PID 3216 wrote to memory of 2372	3216	debug.exe	96
PID 3216 wrote to memory of 2368	3216	debug.exe	97

C:\Users\Admin\AppData\Local\Temp\GV.exe
"C:\Users\Admin\AppData\Local\Temp\GV.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
  .\debug.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1660 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1744 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\.psjob_1780409078385_313435956.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\.psjob_1780409082573_800795057.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:232
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2464 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\.dp_1780409083026_145986732.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\.dp_1780409083526_209752067.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=1452 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=2828 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Network Service Discovery
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\debug.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\debug" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1664,i,17199308767239411854,10793021607024958410,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1668,i,7060230293093572547,1783798974704663558,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=2744 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 58f4f52fd3eab98d88393b63e8b8989342ebd2d30014f0a6924d8038c4b90836
MD5 9ee22d7e2c3d0ab51d0a6c87bbd7ce7e
SHA1 da9cbd50ec834e87eeb1cb85d5eaddd9debcc7b9
SHA512 a909f2a1b209a3482300f8244060dd76edbb7aa5147d8bca67049289d6c9a6c3627dcde9c91cb3807449cc739c64820edb533a461a9179999ee24ae47c71eee6
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cWPiNyDxBPzQh0nRAy6FcI:iq4uYqGEUdncqKXq3qotzYuWq2Iz+vli
TLSH
T1C391EF323375E0D4CC663F07192C19C463AF4396EA58AF4CB258520EE92714BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dc77cf07bb084b64e1d20202d9b2fb6da33216239011e5d497d9f9c7682e1a7a
MD5 d7a58cfbf00f5f906812d80746e2e331
SHA1 013f053a132290123c66d6cbe3f6e7b012ec8357
SHA512 81aa8c23093eb71c1a083d88907e6428612964b2b5cdd25e25e71d0e5ae87f0a0c57e6039dda587033ae594c22628e487c4291eb84f99535428465a4b7f418b5
TLSH
T13B215733B3DCC125C8D9057A108DAD0076B4C7D7009ECE8BBB84C519E97F9A9DB646A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4a3b1f2715b929513b5c2bc4834fc77b0b2fd1416012ad522617b48cb3041b2
MD5 a303fe1a2f9ff11a55d664be374b5b28
SHA1 2ffabc61eb1dcf59e49339d36e1f2f8c86b92c19
SHA512 1e85a53b10926f2c513a4559b74c7f701c3424ab56441b849c4095e408d4ab46b55c30e08cd07d30abac37c0e93a3d5082a6942cd665dd52607241e547c4cfe8
TLSH
T17B218633B79CC174C899017A548DAD01B2B5C3CB049EDECB7A84C108E67F989DBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 331506d14ce2914b0194e36a1b558f0488945ab924418a0768069c5d07c47c18
MD5 0961e054bf61a9a213e0a952196e6c43
SHA1 94a029135950480acc9aa8d2ba970f0182def62d
SHA512 07c542b07576bc9005e7689b5f910189dd38dd42a25a4503a2af37e7251983ea3636cb932c425078382042aed02621860c99d70bbcb6281b48377b048aca2fb5
TLSH
T1E5318B33B3ACC5A5C8D9117A208D6D00B176C3C7448ECFCB6A84C228957F6DADF541A4
MD5 SHA1 SHA512 TLSH

Submit Download

.dp_1780409083026_145986732.ps1

Path C:\Users\Admin\AppData\Local\Temp\.dp_1780409083026_145986732.ps1
Size 652B
SHA256 a5f346fb9525bb257722c7282c8eae225f3654b3185b8b228177df1ce87e0be2
MD5 f24d731c93da2887c9012dfa9b5637e1
SHA1 bde4c9a707c201049c939ca732607b52fa1df553
SHA512 9763945c46ef281014db813268692af84b542697fabb6321cd74f28c116149f6e112af491aeb6b2ceab53c25c7b23d2c599b88a9d98a3a2ad1cd500d773b7430
TLSH
T1B9F0287127A19DC847D14F624426C0545FB4434B43C15C3CB7914901F05A15F8577CDC
MD5 SHA1 SHA512 TLSH

Submit Download

.dp_1780409083526_209752067.ps1

Path C:\Users\Admin\AppData\Local\Temp\.dp_1780409083526_209752067.ps1
Size 656B
SHA256 98c6fc3b2112fb648c60cabadff6a58348286c60a08309995f67e872ca99310a
MD5 bd5e575651c8a165c8acf69a01df64f3
SHA1 8e872dc9499a787565430fd2550d8fefbcad3d09
SHA512 e43f522bfc1b1fa6633d6a369c33f5fafeab21fb2cfb94923cdc0f0ac0b34a7532f4c406a38eabe4918ba03700450e192b35dcc1a5bbf49428d4ce0f122ea476
TLSH
T1ABF023381B60F94997D545026105CA586EBA422F39F6FC073AD14CA7F446B8FD622E48
MD5 SHA1 SHA512 TLSH

Submit Download

.psjob_1780409078385_313435956.ps1

Path C:\Users\Admin\AppData\Local\Temp\.psjob_1780409078385_313435956.ps1
Size 3KB
SHA256 e54caf3c6c22a7f7495f8e7508e75c129ce12afab020a2db00231441bd119bdb
MD5 8326bd6f5f7b3092c00c5f918c82184c
SHA1 37c12ed9602a12f631c53b93f0ddd482f2e73128
SHA512 0aa89d5d5e8b611e4a4b7810fdbe9e2067333062ffc15c6c206fb36b8a52bacdd5ab9e4bf694399012c397956ea9427d93281531a5b155416bd51f60fb4601a3
TLSH
T1B2616636D330427A10D3656268FE471F517583AFE5074705F8BCF153EB9315E8AA906B
MD5 SHA1 SHA512 TLSH

Submit Download

.psjob_1780409082573_800795057.ps1

Path C:\Users\Admin\AppData\Local\Temp\.psjob_1780409082573_800795057.ps1
Size 93B
SHA256 efe864b1abae987a21789c1efef34e006118d1891c2a79192eddf9589b0835f6
MD5 a1b162dff39ba2ca464c2794661449c9
SHA1 ad4049f68313485c9c91b6dab0a1ff9309f4ef4c
SHA512 f99ca96e2615dd258af93fda9f8482db00f96813bf7560644a33bbc2af68bd860b4d513568e3e2bab3af4702d8e55bdc3f3e312d7745ada83ef35eb3e8416fb6
TLSH
T1B2B01210D97584E2D5C309910B0720984A0170ACEC5D0800F8B1F8502104C3C280A354
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\chrome_100_percent.pak
Size 117KB
SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
MD5 750913d55e87def9108e55728ba67d00
SHA1 a5944bc170d1f6c3223195c043134566471dae1d
SHA512 f5663ae3c775e2ec12dda6255afea99291673b8586048b131ca657a10be88cca61e298bb56797bcc34723fc8bf0a3dd966ad8b9f0e77747f963d8dada4f25edf
SSDEEP 3072:7lj4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:7lcYWFUbGz8LI1TdjQBQCrC
TLSH
T1E9C3D0E773B0AD7DDA464BB743560070FCB31B2907C2160E4B9AE479652AB88D9C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\chrome_200_percent.pak
Size 192KB
SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
MD5 d476c19d21b3c2861f08c1c82fffddcb
SHA1 6f61aab7b6fba4fed5a7c222bdb96aee11f23bd9
SHA512 36acefce9f4e6837609f801bb340380f8e3e0de3f01872ef1e9bfd769f61ec2804191b91cfd01d90fb874cc9f4e685de7f2d03c21cd7e0bc6c7d8907f41dc12a
SSDEEP 3072:y6FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:y6IGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1DE1401D323B4AD3DDA530BB3926600B0FD7A20291AB3511E569FED397925F8889C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\icudtl.dat
Size 10.4MB
SHA256 c5da2fc389d1bb0ecb13fe22a8e069b7abc491f8aa5d16eb65d4ff32c85a46b6
MD5 5b29b82022f9697b3010b05b2a71535f
SHA1 eed88ddce48046b1a5c5fcdd19cd9c5a81d8c4bd
SHA512 bffa945bcb95b13e69a438afdcbd6d5a490db902896ed4380c7d7c61a4e53b35d73d44d75eaa7debae65e308b01b287411f168ea4377360045afe8a6b9cfa09c
SSDEEP 98304:D/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndP389o:D/cBhORok2HiXUxO/RJk3IWhlYntjdqo
TLSH
T179B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\locales\en-US.pak
Size 558KB
SHA256 bce3ec06227dba2273c4ff12482cba37b709cc8bf5fd29c4380f9a07b92bf821
MD5 6249e6f03590c631a2a873b3e79058d4
SHA1 b82396e2d4ddcb822254dc999c378642614e7f13
SHA512 3352f438f691067fcdd1cc331cac28130e464d0d9411971ecf7bf8c2d30d32e67cd9a65a71a48dc72f60eaee295dacc9055166dff0bef1f79e0ad4bbb2d0f3e2
SSDEEP 6144:JI1Ecs6drHfBLOFcGfIKUMP99Q8HUfaYQypqs5GjWngK8/uYwj:J2G6drHfBVZMTQ8HSkjZwj
TLSH
T157C44D1FF744112A06A352A2BF0995A2FF32D06DA35112563CBD812C3376B6683B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\resources.pak
Size 6.6MB
SHA256 74c4be8feca65976312f9ddd6ed8f06b669f6a551c91c9b67f9dc76d84e7e97b
MD5 918b877465c1089d08dbb671c76a6ca6
SHA1 76a7b9ef9b58bcc5ac4f20133d2df9293551bbdb
SHA512 41c5d734200bdc276b6a7410bc4b5eed23babcb88f4095696c3049e6885efe7766a9066ea8e3f48249f6588a81d78d67875bc5849e479e2dd5363bcb26b60ffa
SSDEEP 196608:AsBRgrfB5GE3u4bkriACmZnC3gEL34tYrW:fTI6AkrDntEoYrW
TLSH
T1376633D267D2A81FCD80677A85488F35599C6E2535D0B1A3448D6129EEACFAC0FC0B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\resources\app.asar
Size 515KB
SHA256 107aca9c6f66b3a2d1db39f9eee6192b9125ab62796538b7457c52de95c4079f
MD5 96af5a362b72d7aa2ae416bfeb4cff07
SHA1 73aedaf5937d82758fd3ad17b07cc80fe9dce8ef
SHA512 c6d41930b93c0f418ef7e54f5f36953aacf88860aeea05bc423dbb92c0f2d3cca7871260864bef510d189d90fe9c62521b3a0faf237459f9fa143630d8131e4a
SSDEEP 12288:RH35Mj3Gmu6fLH5Q5zKhJFeYkAZIwove4jcvIS3XBfLYuWvznMgYlh0yH0w8798j:RiLHWiUokHg2O
TLSH
T128B488D42792E107618E0363BF066AE9D13FEC72A9C8E94BD164799DB4BC84BD1B4DC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\7zS4541.tmp\v8_context_snapshot.bin
Size 704KB
SHA256 a04efc1404d85595fb2c9c00268f6d49aee41cb63897ecb9ce5408a68dbb041f
MD5 c3d05cf39d1bc037f972f75244b4c04b
SHA1 7f450d2b750cf55dfbae7a6a62190800aa10e6b4
SHA512 049967ee513c026c83c43f157441bc7fc686c41303e3bf42998b4f21a2f0be2e3e8593e617d3e8a3e5614f6162002a1f40b65792fc5c13e35f2ea9662be463a9
SSDEEP 12288:D15XrgG4nwB2NdOeP8POqYUdEMH+jURWYS:D1n6C4H8POqYkEMH+AtS
TLSH
T19AE49676FB0ACA26C8657A7D8DE74B063A34B2DD8EC6EB077011937CB4B86544D1E20D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2xkaj5r1.z3d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xkaj5r1.z3d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2136-53-0x0000024B253C0000-0x0000024B253E4000-memory.dmp

Download

memory/2136-41-0x0000024B09830000-0x0000024B09852000-memory.dmp

Download

memory/2136-66-0x0000024B253F0000-0x0000024B253FA000-memory.dmp

Download

memory/2136-65-0x0000024B253C0000-0x0000024B253CA000-memory.dmp

Download

memory/2136-64-0x0000024B253D0000-0x0000024B253EC000-memory.dmp

Download

memory/2136-52-0x0000024B253C0000-0x0000024B253EA000-memory.dmp

Download

memory/2136-51-0x0000024B25380000-0x0000024B2538A000-memory.dmp

Download

memory/2136-50-0x0000024B252C0000-0x0000024B25373000-memory.dmp

Download

memory/2136-49-0x0000024B22FB0000-0x0000024B22FCC000-memory.dmp

Download

memory/4244-104-0x000001A77F950000-0x000001A77F9A0000-memory.dmp

Download