51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/06/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
Size 989KB
Sample260627-vcadaact9m
SHA256 51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634
MD5 a1fb8a7bf9e843a85afacbaa79e1dd99
SHA1 94a7ab6bb75e8e7ecfd943fe2608305846fee3db
SHA512 2a89ae826aaad283600a2a9913628015199f4021ec38ba231b53461479d434a8425200fc6859f79bf7a6663ad087da9e59ecdc1325f5637b2111f80bb95a99db
SSDEEP 12288:QD6a83ZQMKG6UYCSMxq6yn5BJYLEzhvxwxhDREtcI2wbYhjNjpUIbfMTo/:/D3Z0Gpzq6eJYQZ8bEtih5nt
TLSH
T194256E2E5B5801B8E1B6C1BDCE878D02D771784903B199EF0BD08E525E6B6E45F3AB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5060	powershell.exe
2904	powershell.exe
5060	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	api.gofile.io
26	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
8	api.ipify.org
13	ip-api.com

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
5060	powershell.exe
5060	powershell.exe
2904	powershell.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeIncreaseQuotaPrivilege	1732	WMIC.exe
Token: SeSecurityPrivilege	1732	WMIC.exe
Token: SeTakeOwnershipPrivilege	1732	WMIC.exe
Token: SeLoadDriverPrivilege	1732	WMIC.exe
Token: SeSystemProfilePrivilege	1732	WMIC.exe
Token: SeSystemtimePrivilege	1732	WMIC.exe
Token: SeProfSingleProcessPrivilege	1732	WMIC.exe
Token: SeIncBasePriorityPrivilege	1732	WMIC.exe
Token: SeCreatePagefilePrivilege	1732	WMIC.exe
Token: SeBackupPrivilege	1732	WMIC.exe
Token: SeRestorePrivilege	1732	WMIC.exe
Token: SeShutdownPrivilege	1732	WMIC.exe
Token: SeDebugPrivilege	1732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1732	WMIC.exe
Token: SeRemoteShutdownPrivilege	1732	WMIC.exe
Token: SeUndockPrivilege	1732	WMIC.exe
Token: SeManageVolumePrivilege	1732	WMIC.exe
Token: 33	1732	WMIC.exe
Token: 34	1732	WMIC.exe
Token: 35	1732	WMIC.exe
Token: 36	1732	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1732	WMIC.exe
Token: SeSecurityPrivilege	1732	WMIC.exe
Token: SeTakeOwnershipPrivilege	1732	WMIC.exe
Token: SeLoadDriverPrivilege	1732	WMIC.exe
Token: SeSystemProfilePrivilege	1732	WMIC.exe
Token: SeSystemtimePrivilege	1732	WMIC.exe
Token: SeProfSingleProcessPrivilege	1732	WMIC.exe
Token: SeIncBasePriorityPrivilege	1732	WMIC.exe
Token: SeCreatePagefilePrivilege	1732	WMIC.exe
Token: SeBackupPrivilege	1732	WMIC.exe
Token: SeRestorePrivilege	1732	WMIC.exe
Token: SeShutdownPrivilege	1732	WMIC.exe
Token: SeDebugPrivilege	1732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1732	WMIC.exe
Token: SeRemoteShutdownPrivilege	1732	WMIC.exe
Token: SeUndockPrivilege	1732	WMIC.exe
Token: SeManageVolumePrivilege	1732	WMIC.exe
Token: 33	1732	WMIC.exe
Token: 34	1732	WMIC.exe
Token: 35	1732	WMIC.exe
Token: 36	1732	WMIC.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 5060	3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	86
PID 3308 wrote to memory of 1028	3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	88
PID 3308 wrote to memory of 1228	3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	90
PID 1228 wrote to memory of 1732	1228	cmd.exe	92
PID 3308 wrote to memory of 2904	3308	51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe	103

C:\Users\Admin\AppData\Local\Temp\51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
"C:\Users\Admin\AppData\Local\Temp\51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe"
1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NonInteractive -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp', '$env:TEMP' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -a -c -f "C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\File_Grabber.zip" -C "C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber" .
  2⤵
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName, productState /format:list 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName, productState /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoProfile -WindowStyle Hidden -Command "Add-Type -Assembly System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::CreateFromDirectory('C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo', 'C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\..\Nexar_Report.zip', [System.IO.Compression.CompressionLevel]::Fastest, $false)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a9c2268a32d4b53421c510878be105729a41bb03d01622456369d322e3e35c5e
MD5 ffaa33c7940b1713a06a430414e2fed0
SHA1 b1ade7d02b641ac9c382fad82cb1d31362fafb91
SHA512 61913fe437de06bae8a99a02f3ff35f483d06ddd9593c16f9bb652dde94930ff47f1a07765b2d78ac5108abb65837a66444dc7ff9691ba9c9ceaf85f0ae73f4d
TLSH
T17C112223F38C8920CC96163A509DAC5172B686CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

Nexar_Report.zip

Path C:\Users\Admin\AppData\Local\Temp\Nexar_Report.zip
Size 11.1MB
SHA256 996aa87cdf332e179b08310e53ab9e8f7345c8d8106c71bbbc7023ac67ce45dd
MD5 493a998f694db3d1eb9b9a84d2e7efc3
SHA1 e4be0f42ff59d526871ff8568aa3b03b9e38236f
SHA512 b3f55ef5c74f86692e3564c2aa16ff3792f3c9f7868fbd5da0219efb156a9edcb46049decc80e82886a9e48cc6e9ef7b5f108c921a7d2c8fe2cb41934a621f04
SSDEEP 196608:nT6nFxVXqddLI9MDB+DU6UxN3tu1ybaUDrn+1tBdDLnkqV6Xq94:nIFkgXQ6CZnbaqzSzvUqW
TLSH
T101C633CF530CD7E3D25CE011548C89BB5152AE958A34E291EECCEFEC92F0A526C677A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vklekp3a.5l5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vklekp3a.5l5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 3KB
SHA256 dbef78013704a3eb283b2396eab330767a863f2037c0c12d569bf4304099eba8
MD5 58c322649e0f4772643162d9c4cb7a88
SHA1 58a8551774a16935d18ba220e9e64603aace16b7
SHA512 f33deb38f93b4528215041dc6ecd1ff1bc82fabd2c6813cf1ed6e0ee85963e9ca75ac073789812694bbb0867c6c76e4fadc57ca10fac86e540910288abb77ae5
TLSH
T1E061EC1B89C7B12E8095B5B3D525F89EC121BECD6FC8BDFC9A2C010D2590E8E75E5074
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 1KB
SHA256 6f6579df54ef4e43c391559bedb8264a034360a2c20bc55bdb359829c906c327
MD5 b887cb839de560077538c6733c016c0a
SHA1 fb3202f63590cb59b2f910b9e3c0dca6ee1c1614
SHA512 ef0d8c3bd579c4f6ea5934a7e0f3a564a05e08e383f5c8749eefa41e4bed628a8f7c21558ac0468c7ec87d86dc58ab190657e603dd392d983cc6cb14d9b3492a
TLSH
T12321251B98D3B22AC4A434B3C225F99ED425B98E8FCDEA3C6E3C140C3165D4977E5621
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 562B
SHA256 0a2208771f3d9bcd6194c593d167f42a9c7457fc83a0e41f5879ea893e72d088
MD5 864d1de23b57a201491d47bf1a678920
SHA1 daebd8d58a756608ffa9db97334a1c776d918006
SHA512 1620a8924ba164132871bd364b2aabfc39902345d52ce208df5279b02bc05ee40bedf729b98882cb64689452a837fc8a0dc5acdae9061aaf472256bbb2a6b0ca
TLSH
T18EF0811788E3F23AC9D414F79215FA9EC431FC9E1FC8EA38593C580C207A89975E6121
MD5 SHA1 SHA512 TLSH

Submit Download

nexar_run.log

Path C:\Users\Admin\AppData\Local\Temp\nexar_run.log
Size 2KB
SHA256 2196d6fddd4500d151188a5ffa7a97388979539450bfacb563efcab58367bcde
MD5 8bed3c150c32eaca1ea681a733dfcf67
SHA1 4a3f46017638763a4fc598eca17af6ce6a5d34a9
SHA512 b1b9f80f086d516b189f743b53c6723830e39ebf2d0464f0c8aaa30cc5a092c8a541464315c7793e0211626a7b59e2b45321fbda323e0195a929a2a78dc8b58e
TLSH
T1B551981B89C7A16E80A5B4B3C924F8AEC521BECD5FC8BCBC9A2C010D2094E8C76E5171
MD5 SHA1 SHA512 TLSH

Submit Download

ClearPing.xlsx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\ClearPing.xlsx
Size 11KB
SHA256 60ca6083840a52a2e8be8207be4df63223572844b70d557a6261d04e45407cbb
MD5 c270d696e9ff68d8a0582faa7ebb60d9
SHA1 687990186a853fabee88d8be02e7549570cdb4e1
SHA512 40502f126f14fb8a73cb48a0d284ca82c6836527c0bc9cb62622161a7b8e2037f5cac0d98dd3d03a2b6fd9ec5b2c7672ea713ab515ee9c198426877bba609e0e
SSDEEP 192:wc8mVHDZb3ULURMqjaFUlbVvevUqzQXpS0bLqISu0NlIgao/:wc3Rx3YUWvUlM9z6pTLhSX6gao/
TLSH
T137326E2AE0A46429C17B4878C15B01D7768D3144D70179DF2A99F11F66826DB22DF3AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindSplit.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\FindSplit.docx
Size 13KB
SHA256 09f8a61a63ee3feb8de70e9e9b7eba4347148ee9e7d98c3fd4f3bb8785ad6835
MD5 32f261c11e2df435730eac8d3c3051d9
SHA1 0b5e8e1e83d52fc72f61931ffbae30bbe87904f7
SHA512 f1068e903ca4ed8d95396db8f4c74b315f9076d08338d246ffdd7c845ca0cc0c754e1e1c973570d9739240f87f1e01e105ad8d5065d8b18182feb6f62bf94ac6
SSDEEP 384:a4oGH7XD0abEgPrtdNxt/ZtNN50GNaPIFHgCWtrA:3o1abEwrNxllN5BN6ItgTE
TLSH
T1B752AF68D5141430EA338B7CC0AE13F2EA1E61022B15D58B316DFACF17A6E9B5B0375A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatGroup.xlsx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\FormatGroup.xlsx
Size 10KB
SHA256 37b0b7f6e2584c978aeb2f35f5fb6f9262d98e3a75974decb7d04a1a9252028b
MD5 2072e3ec680baede38de0f3242ace274
SHA1 02f2802af91ead80b902b8d97844449f4cd778d1
SHA512 11530c97157d5fae5e2d71622a8f12e3fe7b3b9ce0967f175ab3d6fca909f501d32e0ed6030119537c9c1ff4913628411329dcc0685ef9326ebcc36e825dd6b5
SSDEEP 192:wc8mVyFVq5Cb3Um5UCmjaFUlbVvevUqzQXpS0lTMkcoao45:wc3cmQ3xUWUlM9z6pJnao45
TLSH
T1ED228D25E5795815C227C47DC18E02F2B92E00528B85759E7890F1BFA6852EB13EF1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportUninstall.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\ImportUninstall.docx
Size 17KB
SHA256 8e4f98411a96af838a4eb22614b57f79ce58c696912d15c0d9f4bf281856c300
MD5 ff91e5ae754a897bd603dd1e6ccd1fad
SHA1 a8d45bfa6719769e31d9c3bc070f3ad94786d394
SHA512 9bec456c7b5b39adef24f59ead5ea5fbf93747e3fab8eff36d74fe8759568a018107f4c987a321238a3065370a6a44424f53e02bc6ff85182970b1e609d9bcbc
SSDEEP 384:aGGTojiLP2c8wcT/H6PCdNxt/ZtNNNaHIFHslUs6Q:ITcccT1xllNNYIt+D
TLSH
T17182BF68EA41A960EED3CB7CE01D02F0E61DA042B146D4DB20ADB74EA6D7BD317171B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenFind.txt

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\OpenFind.txt
Size 687KB
SHA256 d9227c4bb830c0262dec5a0cf2546c6613fae0a7cee65ebd7f00c7278485a012
MD5 cb42ed0405e38abb1ffebb4df5eac3a7
SHA1 0385bbd50000d4cbc078da5ab42003e440f10451
SHA512 37d0774dbc8c76b20fe29dede432f36114a8a3ddbd52da5319c60275787c80205ddad317f8573efe6f172884168b685be86a0b46acb0822ea37f939989246794
SSDEEP 12288:VXs1rYUUE2cIPFf2HcnklRCQPSEsxGpLkcW7S9e9cI+HBFPlPGgC4jw:VXs1rYfHFLnkl0c5dkc4cvBFJRjw
TLSH
T1D9E423FEB08CB2C0C228809911CD84AF94C475D26669B396C6A497DA5BBCB9737CB714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveJoin.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\SaveJoin.docx
Size 20KB
SHA256 f5ded00ac0133fb7adad07c941786c91d2c20f35752266738a9654305a5949a9
MD5 9cf776311bf68b7e23d5503359f2d7ce
SHA1 3d7939738fc69a34ecc9a72de9bdea1b55a5dd87
SHA512 d3a7d48c0951aa4ca72f0830e648b42e58f471950df1d1db95ab4b6937c8bfd193781f866bb251d22ce0544df20d73ebb0edc97ff036316431e3f7d5bff7edda
SSDEEP 384:a/UsUSsVsWkHYfWPTMTVxiZ1YItdNxt/ZtNNHIFHsYqXDr0:9DOSVxk6INxllNHItjUA
TLSH
T19492C075FC11E131D2A68A3CB0A613F27B0C95962E47D18E259FEADF83A7E034306685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteStop.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Desktop\WriteStop.docx
Size 984KB
SHA256 50f5fb78233bca84816dd4aafafa40bdd523092a8d5225d1d86b4c7cf0270697
MD5 26e4f10f12aa24c9678029d2e37443ec
SHA1 fdddd3c298f5a4dd53b65f26968f18484f90f7ac
SHA512 f8ec75c20480fdc9aa47ac127d7308c8cec4bad188768e384a3bd5c3b7655431045b58b1c757b2b898194f895e09a52b974248f8b3ec3364b9674d1cc7317d21
SSDEEP 24576:AEwfy0/VtqJeeQFgA6kUJeYoqgWHPbTgyucr9dnLe:SHNtqJ2gAbUJgqrzTUe0
TLSH
T15C2533DC0714EE0CF47AFCDADA48E27FBD97D0C58904E60A6D2E3C6D9BA5670839A444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectReceive.pdf

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\ConnectReceive.pdf
Size 694KB
SHA256 01fcc08a9af20c2d7eb3d7e15d615de95a9f36fbd7272c7fcff0e4cba8602716
MD5 026ca308fc27eac2371afebf37beda64
SHA1 a6d66a07f93e61912c4b29b13b12602a458b7370
SHA512 2773eacb3dc1b68f50f561c399b81dc9b41860b4ecad9371c8ce9f57376daba26dba0da4d42350b7fdae3322747044c29104f18ef790e3964c19b063738d39a3
SSDEEP 12288:Ha6k/OjvNZ0Cjt5w90D52S0Qv+288qu/fyiylIbgqCkgeCu0HbXHh7w0ORSWPYC6:66txLwOD52S9228snoqkqXC3b3RORHxU
TLSH
T10BE433CDE33CE3E715E4792BB024266176822CAC195A4991EFCEF4C1E43B02576632EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\ConvertToTrace.docx
Size 20KB
SHA256 9ce57530e71ec124be42ae1c0229115d861d13847009305f668813287e85d01f
MD5 98d79e86e3ac9343a1b66d4d5dbf30af
SHA1 a7aa3922e1fadcaad2455773379170e2a1aa4cc5
SHA512 55f2ab66cf9a84823bcea2909d5069a7acaad4ba39557dacbb4149f750b3be771c71869c550c4c92f8919ed76a6151dc7c5acf28ee465fb3da7e725ca6e03a6c
SSDEEP 384:a+sKkX5GsMj4egSwUllol0RauiozzdNxt/ZtNNC2YuIFHsalm9:pxkpGs+ZgSX3YEeGjxllNCqItbi
TLSH
T11C92D177DB50A420E2A2063FD01B12FDE31D9405BA63C54D319E774F7736AC2AB1BA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditBackup.csv

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\EditBackup.csv
Size 843KB
SHA256 9f124e43a5a7abc71d1e4b94128ed4127e2ccdc1c634689ce3192cfbbc0b576b
MD5 2226456213070ca1ae78c22606a58f9c
SHA1 7169f2102c3b0a517c26730a1eefd99f051d8d09
SHA512 968d15e73ab1bb3dc48606c5604656525ede000d6059d3ea60ec4a781451bd6c95bfcb41f07a98a3d389487bbc136ae38b756cd3ad72f76fcda0a7ce9a2c1ab6
SSDEEP 24576:XRjvk8nall4ViunpwcmGEZbrsYi0d0/24oe1w:Brkmz4undgbji0d0/24oe2
TLSH
T1B90533A3098A91F2CE156141F1ADDBE301635DC91E36C8385B4CED36F2A65E92D3F4A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrantExpand.docx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\GrantExpand.docx
Size 13KB
SHA256 b28c4c48528b225ec99b3a04e190c5933f7652c7d63858752791c9e821306499
MD5 e001ed510786b39e48fd3ddccf35721a
SHA1 2391795f41554418c7cac2813773c9a903be03a1
SHA512 64e28889e1147f6dea4702bd7c5d1f69f36408c866d9390a89d4eb961a441f685ff57b1c9c6fddc5e91b8dc0c20f43dba78a12445d22be42e692489c80c201bb
SSDEEP 192:Ctxvt5/zfWECCNxtpgoZ22NNZXwveTWNGFHBElH+t8YVs:axvtBfTdNxt/ZtNNZcIFHg88YVs
TLSH
T18652B07CC105AC41FB638A7CD01E12F6E81A8101B712E4573556BBCF92B369B0B17B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectPublish.rtf

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\ProtectPublish.rtf
Size 620KB
SHA256 934c14754cdb27034071f4284a7766f15c4ea7dc045efc8edf11efac4a2c6193
MD5 8d14ad248ffc4743d97d6a5cdaa0d41e
SHA1 0817d5009429fe9151fab412b232636a2216aa45
SHA512 92e09c7efeac926f87c85d77fa8c10a07de828578b6fa6062911fe77880b3e58593a6b2f817ef5acd46ba59233c7345eb49227ce1bd4c73e23d4d113ff108d26
SSDEEP 12288:4oF1STDjhNZ1WwV/MrU0I/dUpoXCoItsdoW/aDwmKNGFdwrIUhoi:HF1STv515VkrS/dU9Fko+aDwmHHwcM
TLSH
T16FD423C9373D0B6A12DFF44978805E6D99341F4E8A2173F36A5496D86283FCAB831DB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitEdit.xlsx

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Documents\SplitEdit.xlsx
Size 12KB
SHA256 7f224ddb0bbbf4eb21ef7bd857db9ed7281f30ddc9e3dc78416be6eb64550c85
MD5 44f460c93546404926e54f5840d35de0
SHA1 6c256d14cd10f7459f4ebcd21f11fa47e3527179
SHA512 a869a0945a951a4978c3a146952c2d869b486bef76e8f792ef0823e5ae1539162236316fb34398fde8311632eaff6913174f72f785f926af4d7c6f7c790637d3
SSDEEP 192:wc8mV2ocl0b3UjtbAOVgaFUlbVvevUqzQXpS0RCypfQlrId+cr6aoCU:wc3kLK3I/VdUlM9z6pHkIAcr6aol
TLSH
T166429D46B195AF35C50EE43E82EA05F573CC70949F03791ABD20B3BA27411CB258B5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupUninstall.csv

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Downloads\BackupUninstall.csv
Size 221KB
SHA256 b40b33d0cbc8774172152ec17567df033685fd4a499b4e7e6fa193cdfcba5ee0
MD5 a421f10081d470277a8fba488c0f2037
SHA1 c8261493d6c02cbc768b76cfc3c65494756d9eda
SHA512 085b385c900b5cb052b509ebf8e848232686afed4c64cb2ed661131a0fbb4991a1c1a75ddb1bd30f847403bf6813f4aba5d377b27a72f482c67dffa03d388a22
SSDEEP 6144:gG2ZfgVWktf96NPTriuJTpErz3xofv3Me1YUEja:YfgVWg16pTrikpQdofz1YUZ
TLSH
T1312423407C494943362C97028E1DD6B13AAE666ACEF23351FDC8E6BDC5B902218467EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeasureRedo.rar

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Downloads\MeasureRedo.rar
Size 481KB
SHA256 cee57cd15d746818f425b549d3a5533ec963de45af49b1fab1b897f1b21a595e
MD5 d996f09805d1dd16369515a384da4afe
SHA1 4078e7589dcd160d04859ff3dea1ab729ec752a7
SHA512 e8a062eba0ad699752bb45e531b9820f787116384ef6bffe9084217001c23b33775d63e6bbedf7803dfb342dca41cf44566f1702a6fb4f9e071e2b0ff8e74191
SSDEEP 12288:8UkRrgK8ue5n/4C++jLvEnOJQ92L8jgJLkBNrBPb:8UWgK3e5/J++jVQ99jmLSNFPb
TLSH
T120A423DAB2686CED33D5D63310866C7D862CCF01286EA1A0537FDEBE44D591DCCE9A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAdd.txt

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Downloads\OpenAdd.txt
Size 364KB
SHA256 060895b7d007a2b7a614aa0f66aab691bce93e7b6270a46c25033b653cf5739e
MD5 7252d71dd99f423949d77f3f1d653b41
SHA1 d11bf3ac4fdad62b41a95b5a2361b7b996336911
SHA512 64c3232d8b53eedb35e7ab06a13e43e4b6b5e278b3d4e552d935032fb456fbd0c00a4bdb9ac991e69b699f463e9d19230f99c920ecff84f999f55e61262e9eef
SSDEEP 6144:XdWIvPzu2M0guv/X2cx084vsGhcjRqH0lpA+n4HsEixw1DFnfDVVjx4KEkv1U1V+:XdWITur0guGPRhGhp4NawZVfDlnvm1Kb
TLSH
T1E08423C30C6DE736C2CC0B1C53BC22B7D5AD6FB687F41E95A8684B4E6190A0F91D9768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUnpublish.txt

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\FileGrabber\Downloads\SwitchUnpublish.txt
Size 403KB
SHA256 93c7ed842559976a3ac98e7830075102faae094f086e53c153160038c6677c7c
MD5 e67ffe5fc651d95e229aa9c0cd6e589f
SHA1 a27ef9a0322907f660a3a18e215ff82b204d7ab8
SHA512 6584cc815a4d4b3ce39633b3d81b1ac25a42383aac27d54b766f944623764c233b63b16ed510c023bf9bbe70e05ab122d63aa395a18553da17b8bfcb4441242d
SSDEEP 12288:NfO/qJQFS3E4Q8aPYAKqQ017jKYEtqRPS:NfO/qJCS3b/aAAbKzv
TLSH
T15C9423A3E3CB92EB7443A4F08C611D085356F1BBD332F491F4A0549CE2D17A9196797B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

File_Grabber.zip

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\File_Grabber.zip
Size 5.3MB
SHA256 723d31f3208e8c411eeeb6bf277b1f228f739ad03474827d69a1bbb743f678c0
MD5 251b15da6a9d6b14b8b1d86aff22548b
SHA1 d434c4be4b578c70bc4cff9dfe99c34c2a1a68e5
SHA512 c68c0f2dd01b14fa7b3fa4e0c4fada284c9eff49e6718a2b447b0da481af50b418bde8d48dc484c27c5ee4072b693333c58b320d4f80f1eb68e5bb0ef903e3a6
SSDEEP 98304:DdJ6ZCneP1ftq7btqSpCIs8usoGdFJtkRKlPwrhERXFEUUHWyFjA:xJ6ZZpt76ndFQRK+riRuUUHFhA
TLSH
T11E4633CB630CE7D3D29DE021904C897F51526DD54A30E252DE8CAEEDE2F1A617CA77A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\screenshot.png
Size 587KB
SHA256 4c0b9680aa3ba4331358cbeb94b25f8b1144673de863b8a8e5c7986d50d0d122
MD5 8935af2e40561a20ffb8aea1823da3c0
SHA1 23c2eacab0e7d93a3317bb667a978a036a8cf380
SHA512 26d5ccaedce3deacde5bf27df6cc08eaae6dda4eeb0777501ed0ea9c68f9a9dc0ef332447feb229dd43b0974c95feecc0a12f5f2c78f02a61c1c972c410719f0
SSDEEP 12288:/cwgYsQhwbPvPXM65FgFAW68BtC/lJO8CAB7/6f2Z/8wUuxao6nJ:RsiwbX065FrW68IlrCA57NHUuxao6nJ
TLSH
T1B6D42215B5F8826EDCAB543FEFC82F9B4541806889BF5139A71BEC224581F883D167E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\nexartempgDHJIo\system_info.txt
Size 807B
SHA256 148edd8511a97e028cdc0b84b29956b3b63c0b61251ae75aa87b1532a0d24c4a
MD5 e089e6558ca9902a8a62ef56a7b98ed1
SHA1 e6cb8384d78894bcb0c8c51708741e2f7bf94f47
SHA512 d66a37911a2b0b096bf3f21b5f88aa9f192126c06b15f873fecfb762702c71d357b4ea99fc3551cd38e1215b73d4e905b575dd96abc7f69160b96188f2a48424
TLSH
T13601CE60E3160C0496492AA723164FB7262D50C65219C7FCACCE9188798E02E7BEF01B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2904-121-0x0000011F576D0000-0x0000011F576DA000-memory.dmp

Download

memory/2904-122-0x0000011F6FD30000-0x0000011F6FD42000-memory.dmp

Download

memory/2904-127-0x0000011F6F810000-0x0000011F6FA2C000-memory.dmp

Download

memory/5060-11-0x000001DF290B0000-0x000001DF290D2000-memory.dmp

Download

memory/5060-9-0x000001DF29090000-0x000001DF290A0000-memory.dmp

Download

memory/5060-10-0x000001DF29090000-0x000001DF290A0000-memory.dmp

Download