696420e2d8f3d36081022d71db11ae48b5bb17b5c4f46db590745044f706d7f9

Analysis

max time kernel
298s
max time network
196s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/06/2026, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bjbh.exe
Size 6.4MB
Sample260605-zd1dbadx21
SHA256 696420e2d8f3d36081022d71db11ae48b5bb17b5c4f46db590745044f706d7f9
MD5 34978f641bcce63b3a43d2865a7611cc
SHA1 ee45e2b8797e43fa306dc0b72d7899481f1baa2e
SHA512 a447c87d1d51deff4a600b9241d8a7a5a0829f723342a5b5b0ccb9b752b7e93d88086983d414d8a5a717ae0db1df0b3bdc3d287fe4374241acf55422394046db
SSDEEP 24576:HJPVHaX0RWmdwIkAeCCVzLKLDR7+R4R31IKYkOgDg83cjFAWvFz/nBele7tKDyio:HJdHaERix3CCVz4DpNIh8mXrngm
TLSH
T12E667C0BACE408EAC56AA33289B35192BB75FC490F3263D72E51B6382F727D45D35718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2688 created 3340	2688	AutoIt3.exe	57
PID 2688 created 3340	2688	AutoIt3.exe	57

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	4616	bjbh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	bjbh.exe

Executes dropped EXE 2 IoCs

pid	Process
3980	V3Y3nFJganp1aUL7pzNkPLWG.exe
2688	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	V3Y3nFJganp1aUL7pzNkPLWG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.myip.com
12	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2688	AutoIt3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1280	chrome.exe
5316	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
5348	chrome.exe
5348	chrome.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2688	AutoIt3.exe
2688	AutoIt3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2688	AutoIt3.exe
2688	AutoIt3.exe
2688	AutoIt3.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3980	4616	bjbh.exe	82
PID 3980 wrote to memory of 2688	3980	V3Y3nFJganp1aUL7pzNkPLWG.exe	83
PID 2688 wrote to memory of 5348	2688	AutoIt3.exe	87
PID 5348 wrote to memory of 2000	5348	chrome.exe	88
PID 5348 wrote to memory of 5320	5348	chrome.exe	89
PID 5348 wrote to memory of 5320	5348	chrome.exe	89
PID 5348 wrote to memory of 1280	5348	chrome.exe	90
PID 5348 wrote to memory of 2652	5348	chrome.exe	91
PID 5348 wrote to memory of 2652	5348	chrome.exe	91
PID 5348 wrote to memory of 916	5348	chrome.exe	93
PID 5348 wrote to memory of 6032	5348	chrome.exe	94
PID 5348 wrote to memory of 916	5348	chrome.exe	93
PID 5348 wrote to memory of 6032	5348	chrome.exe	94
PID 5348 wrote to memory of 1660	5348	chrome.exe	95
PID 5348 wrote to memory of 1660	5348	chrome.exe	95
PID 5348 wrote to memory of 5984	5348	chrome.exe	96
PID 5348 wrote to memory of 5984	5348	chrome.exe	96
PID 2688 wrote to memory of 2960	2688	AutoIt3.exe	97
PID 2960 wrote to memory of 3232	2960	msedge.exe	98
PID 2960 wrote to memory of 5316	2960	msedge.exe	99
PID 2960 wrote to memory of 6136	2960	msedge.exe	100
PID 2960 wrote to memory of 6136	2960	msedge.exe	100
PID 2960 wrote to memory of 6136	2960	msedge.exe	100
PID 2960 wrote to memory of 556	2960	msedge.exe	101
PID 2960 wrote to memory of 556	2960	msedge.exe	101
PID 2960 wrote to memory of 3600	2960	msedge.exe	102
PID 2960 wrote to memory of 3600	2960	msedge.exe	102
PID 2960 wrote to memory of 3600	2960	msedge.exe	102
PID 2960 wrote to memory of 4168	2960	msedge.exe	103
PID 2960 wrote to memory of 4168	2960	msedge.exe	103
PID 2960 wrote to memory of 4168	2960	msedge.exe	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Temp\bjbh.exe
  "C:\Users\Admin\AppData\Local\Temp\bjbh.exe"
  2⤵
  - Downloads MZ/PE file
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\Documents\Screenshot album\V3Y3nFJganp1aUL7pzNkPLWG.exe
    "C:\Users\Admin\Documents\Screenshot album\V3Y3nFJganp1aUL7pzNkPLWG.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Reload.a3x
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fffa53fc728,0x7fffa53fc734,0x7fffa53fc740
    3⤵
    PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,3931116610845201941,13225504883498469046,262144 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:5320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,5796894463721496411,10737358557079626749,524288 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,1618049475942106539,10205926595652864567,524288 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:2652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,6686138223361332669,6020932091004620137,2097152 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,10188886870060999894,10315342395510475153,2097152 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:6032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,8453792450595951766,13312363909545342897,2097152 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4208 /prefetch:2
    3⤵
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,4251170704068736517,10031382265344222626,2097152 --field-trial-handle=2028,i,16947083365316915905,10158733045551559417,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fffa587c188,0x7fffa587c194,0x7fffa587c1a0
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,4748134365671669170,16456590582586413356,524288 --field-trial-handle=2332,i,8793367483514113086,1744157168532842218,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,15734163791285230437,8410145487386830989,262144 --field-trial-handle=2332,i,8793367483514113086,1744157168532842218,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,9318071601452489115,13587053878434980916,524288 --field-trial-handle=2332,i,8793367483514113086,1744157168532842218,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,16620437932222462922,12124992649992431987,2097152 --field-trial-handle=2332,i,8793367483514113086,1744157168532842218,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,7982858722432183719,7145175333619618764,2097152 --field-trial-handle=2332,i,8793367483514113086,1744157168532842218,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5c13c505b14cf2300e6eab17ea70e7479324ef1ef25b7862d756df9185856c20
MD5 f0aca824c0448b96eb27d7dde2d299d8
SHA1 50a1c08a83269d29975b745bec7a0108b760df2a
SHA512 b6dc5f6f79f1370a90a2937c452c39fcf8862992295fc6d50c240a4735525fe02886a84de60a4460a71e2cae3807cb938eb6f1199ee6fe4a5cc72a3c3ad622ed
SSDEEP 96:eNC0d++nHQU0Ttfy95z4CRDotok5xCP0DxC4B6PJGyvyL9QNaC7HBC1Zwh11a:eNC0RHCw955DUDpJo0N9QNbHBC1q1s
TLSH
T134B1EBB6D4698C77557A85C6F5066B06CFB4F0EBE6606E989DDD1F0D01AB0E81302532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d2c3fcf601fc44eb7dfd29aa0b053836b67f1281b1ec146cb781b5ac01333482
MD5 bef411200dd11584800636a11b884ef3
SHA1 0e61c2b5662acc205948f2bf930627ee5827293a
SHA512 bfea5d102d24e0c54d143b7e495fb8108d471c21e13f91a04ca68d2549bea61cf5b1476b280801a8c1c16a058b20af9ad3f89a9908d6c81b4fb512d00cd2fbbc
SSDEEP 384:nmDiF9CcmyWCs3sNT8TUNTUlImkrzoNmRitweflV63CrscQ6zehkP+lFYS/4RHyZ:muFccps3swglGnVhnQ6KhkoFYS/4g
TLSH
T1EBC25A36DCA4CAA7EDF78FC9EB4A7A47DEE00163868859D4DAD81D1D00C719C134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dddafb5053d1bc7a2aee8c2550707678141ecc2efd793a7dc9220c6810cdd41b
MD5 22372b34645dbc22f34a18ce37eadf1d
SHA1 ac006bbf60c599aa13a2d9e6683acf616432b7f7
SHA512 7fc9e48e1760754ccebe497dbcaa43e445847caede1d6ad4e0be71fb4b2e2b1e8bd15d0c081ef21e49ec5eb1c1433a2f42b04679cc4c9bee1b584c1ee79ecbe9
SSDEEP 384:nmDiF9CcmyWCs3sNJ8TUNTUlImkrzoNmfovweflV635Q14UahkP+lFYS/4RHy/79:muFccps36wglidVEQ1ghkoFYS/4g
TLSH
T174B25B36DCA8CEBBEDF64FC9EB4A7A47DEE00163858859D4DAD81D0D008719D1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reload.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Reload.a3x
Size 1.2MB
SHA256 6cc8223987f1fc38c128a0a27b2e9dfb5d53a9937839b34221b3e3adf20d51d8
MD5 092c617c4d3ebabec17af1b3c81c48dd
SHA1 ae145d30ada80acfe3847b2657ff5a77a4ca69a4
SHA512 7bd3c9d2c2bbf7be3456b4f5fc1886cc9ca2860a0feb1760e0718137abc2908f8136a8bacea0846dbe709467f1c7371b8250d38d7d4bd6f413c8ac421a847297
SSDEEP 24576:oF8caBJtxFIc5xkQOfs0Q8VwZVAfBYBTG077ZPkFHpPuzRDMVUHZbYBcQY:oFyJqcFTDfPAfSTGvpPwRwVxY
TLSH
T13345339B940E62F3626BB776B3C1986B21BB711700ADFEE43074DFDDA620C176111C6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V3Y3nFJganp1aUL7pzNkPLWG.exe

Path C:\Users\Admin\Documents\Screenshot album\V3Y3nFJganp1aUL7pzNkPLWG.exe
Size 2.2MB
SHA256 04fae87ad99118b414439853eb0950d62a0b37bb7ef62c9bfe40fbe70c5dc00e
MD5 b8aa3afaa82d3475f95bd5e6408f5ba2
SHA1 09cb3b39bd1bc0b2e224d18728594cfae3d0c3b0
SHA512 a14cc32c19c2f8d5805cef16a91f10438c21b5649ddee3f7709441da6102ab322d19ba129b130a73f2840f37445b96664991ea229a1e4c2d68e036c74dfbbba6
SSDEEP 49152:YjQX6kX6tF+TYcJIyfK5f3uGJp2WX9evPSJlPUOYwUaEd:FqkqiccJXef3ump9XAvPSPUp
TLSH
T18EB5020B3AC91662D42FA37170B2033F2333F93816665AAB6197F6D8DE637D33512649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2688-23-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-29-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-22-0x0000000005B60000-0x0000000005B61000-memory.dmp

Download

memory/2688-110-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-111-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-112-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-113-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-114-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-115-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-116-0x0000000005D20000-0x0000000005DEC000-memory.dmp

Download

memory/2688-117-0x0000000000CA0000-0x0000000000D93000-memory.dmp

Download

memory/4616-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4616-21-0x0000000140000000-0x0000000140095000-memory.dmp

Download