351a87c84a846ddec182def70168235f76f568ac7a5d267df70050f7f94e140f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ed1097785cbbac7fcfcf16fdb021ad1e_akira.exe
Size 8.3MB
Sample260709-b6eqbact7x
SHA256 351a87c84a846ddec182def70168235f76f568ac7a5d267df70050f7f94e140f
MD5 ed1097785cbbac7fcfcf16fdb021ad1e
SHA1 42d2ba4e31ac613495b7cb55c17cb2a2bb441692
SHA512 92ab063402260331a30a7c8576389f021b3d6e69adb6e440701a645ff6469c836d1016465a749c165f545d7a4edc65eca5402fee94d237faf527e9ca626c11ef
SSDEEP 196608:HlB9/FLhnuopImdEtkWC+hTirFtxvinviWRDI/Kh5:FB9/1huop7dES/+U9v
TLSH
T1BE963307A572E0FDE97DC0786339E17336A738880B00AD7773E54B78692E995AB09F14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b0-6.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5092-237-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5092-337-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5092-339-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5092-373-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/5092-397-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b0-6.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-237-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-337-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-339-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-373-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-397-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b0-6.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5092-237-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5092-337-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5092-339-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5092-373-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5092-397-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 6 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5b0-6.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5092-237-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5092-337-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5092-339-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5092-373-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/5092-397-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 5 IoCs

pid	Process
5952	DiagTrack_1783561511.exe
5092	system_diag.exe
5796	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
2840	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
1464	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2968	tasklist.exe
1288	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5140	timeout.exe
1748	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3568	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	DiagTrack_1783561511.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	DiagTrack_1783561511.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
916	wmic.exe
916	wmic.exe
916	wmic.exe
916	wmic.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe
5092	system_diag.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	916	wmic.exe
Token: SeSecurityPrivilege	916	wmic.exe
Token: SeTakeOwnershipPrivilege	916	wmic.exe
Token: SeLoadDriverPrivilege	916	wmic.exe
Token: SeSystemProfilePrivilege	916	wmic.exe
Token: SeSystemtimePrivilege	916	wmic.exe
Token: SeProfSingleProcessPrivilege	916	wmic.exe
Token: SeIncBasePriorityPrivilege	916	wmic.exe
Token: SeCreatePagefilePrivilege	916	wmic.exe
Token: SeBackupPrivilege	916	wmic.exe
Token: SeRestorePrivilege	916	wmic.exe
Token: SeShutdownPrivilege	916	wmic.exe
Token: SeDebugPrivilege	916	wmic.exe
Token: SeSystemEnvironmentPrivilege	916	wmic.exe
Token: SeRemoteShutdownPrivilege	916	wmic.exe
Token: SeUndockPrivilege	916	wmic.exe
Token: SeManageVolumePrivilege	916	wmic.exe
Token: 33	916	wmic.exe
Token: 34	916	wmic.exe
Token: 35	916	wmic.exe
Token: 36	916	wmic.exe
Token: SeIncreaseQuotaPrivilege	916	wmic.exe
Token: SeSecurityPrivilege	916	wmic.exe
Token: SeTakeOwnershipPrivilege	916	wmic.exe
Token: SeLoadDriverPrivilege	916	wmic.exe
Token: SeSystemProfilePrivilege	916	wmic.exe
Token: SeSystemtimePrivilege	916	wmic.exe
Token: SeProfSingleProcessPrivilege	916	wmic.exe
Token: SeIncBasePriorityPrivilege	916	wmic.exe
Token: SeCreatePagefilePrivilege	916	wmic.exe
Token: SeBackupPrivilege	916	wmic.exe
Token: SeRestorePrivilege	916	wmic.exe
Token: SeShutdownPrivilege	916	wmic.exe
Token: SeDebugPrivilege	916	wmic.exe
Token: SeSystemEnvironmentPrivilege	916	wmic.exe
Token: SeRemoteShutdownPrivilege	916	wmic.exe
Token: SeUndockPrivilege	916	wmic.exe
Token: SeManageVolumePrivilege	916	wmic.exe
Token: 33	916	wmic.exe
Token: 34	916	wmic.exe
Token: 35	916	wmic.exe
Token: 36	916	wmic.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	1288	tasklist.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 5952	772	2026-07-09_ed1097785cbbac7fcfcf16fdb021ad1e_akira.exe	88
PID 5952 wrote to memory of 5092	5952	DiagTrack_1783561511.exe	90
PID 5092 wrote to memory of 916	5092	system_diag.exe	91
PID 5092 wrote to memory of 5796	5092	system_diag.exe	95
PID 5796 wrote to memory of 5712	5796	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe	97
PID 5796 wrote to memory of 5712	5796	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe	97
PID 5092 wrote to memory of 2840	5092	system_diag.exe	100
PID 2840 wrote to memory of 3524	2840	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe	102
PID 2840 wrote to memory of 3524	2840	elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe	102
PID 5092 wrote to memory of 1464	5092	system_diag.exe	103
PID 5092 wrote to memory of 3568	5092	system_diag.exe	105
PID 5092 wrote to memory of 2968	5092	system_diag.exe	108
PID 5092 wrote to memory of 880	5092	system_diag.exe	114
PID 880 wrote to memory of 1236	880	cmd.exe	116
PID 880 wrote to memory of 5140	880	cmd.exe	117
PID 880 wrote to memory of 2972	880	cmd.exe	118
PID 2972 wrote to memory of 1288	2972	cmd.exe	119
PID 2972 wrote to memory of 2768	2972	cmd.exe	120
PID 880 wrote to memory of 1748	880	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ed1097785cbbac7fcfcf16fdb021ad1e_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ed1097785cbbac7fcfcf16fdb021ad1e_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\DiagTrack_1783561511.exe
  "C:\Users\Admin\AppData\Local\Temp\DiagTrack_1783561511.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Users\Admin\AppData\Local\Temp\system_diag.exe
    "C:\Users\Admin\AppData\Local\Temp\system_diag.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" logicaldisk where drivetype=3 get size /format:list
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe" chrome -o temp_abe_output\chrome -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe" edge -o temp_abe_output\edge -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe" brave -o temp_abe_output\brave -v -f
      4⤵
      Executes dropped EXE
      PID:1464
  - - C:\Windows\system32\systeminfo.exe
      "systeminfo"
      4⤵
      Gathers system information
      PID:3568
  - - C:\Windows\system32\tasklist.exe
      "tasklist"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2968
  - - C:\Windows\system32\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Local\Temp\sd_d3c59b81-6cae-4361-9469-a9ee0a3d3ab7.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:880
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1236
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /fi "IMAGENAME eq system_diag*" /fo csv | findstr /i "system_diag"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "IMAGENAME eq system_diag*" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
      - C:\Windows\system32\findstr.exe
        
        findstr /i "system_diag"
        6⤵
        
        PID:2768
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiagTrack_1783561511.exe

Path C:\Users\Admin\AppData\Local\Temp\DiagTrack_1783561511.exe
Size 8.0MB
SHA256 eec0bfbf51b037a96597ec468e530c0d2d3f1f24b32a195c8f5eb57cc6c05ee1
MD5 954017b8b0655eba9a0369eb2470fb61
SHA1 d3082b0173b7c0acfc0bd75e5bf976c22f343c55
SHA512 1148155b8ce867bebcd34cadd4fd637a74e06ac327aab2c9dcc6b607b5144a949e309af40614feb2cb3c19f93361da386112afebc3f0820d4dd4bb59a6b2dda2
SSDEEP 196608:4MKGttSCh3uPfHoEx3cYvevAabIW9ckMdwZsOIkelFg93kB:0VgePfIC3dmUPk/eOnelFXB
TLSH
T1AA86128AF8850A6CD3E50F7A41BC148BD5DE71C9037045991FCA6EA3BAC5D6F32386C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe

Path C:\Users\Admin\AppData\Local\Temp\elv_f86a0f8e-dd07-4ff6-8fe6-aa391ac85380.exe
Size 1.4MB
SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
MD5 7c9b8c74e6c7d2ac95a7e96eb9f44ea5
SHA1 38ed669edec250bb13c9bad53a79365e5985e61d
SHA512 15fbd4e99bb70def7d17dced847fb18e82a461580ac55413ec13042dbef7d9b7410c54f9301d5207a5fb3ca0cc3b5ef179debbb1dae5e4659068c7d0e34949e6
SSDEEP 24576:URQDAx+qUU8KTG7LMBFZE41m2yRwRkY9342P/dsD:URQDuwU1G7QBtoakY9I2P+
TLSH
T1AA65121BA6A400FDE1BBC274C9124A0ADB76FC4A4771E68F13944F951F27BA04E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd_d3c59b81-6cae-4361-9469-a9ee0a3d3ab7.bat

Path C:\Users\Admin\AppData\Local\Temp\sd_d3c59b81-6cae-4361-9469-a9ee0a3d3ab7.bat
Size 756B
SHA256 9ba3d872c95e5e44087817e4f8e82e7cc3632e498d3b5120e47b1ac4088f355e
MD5 a49da28597dadeba067f08d63ced8fe7
SHA1 438e4c4ba848bb61133a803cc0c2e770d63748cb
SHA512 0b728a500e03b9465612cfd1e90d60b2dd43e95d7be73ecf9c81b5088232f498df151e7b44fd1beb0e199bbb0ba415632981c0c0b24684fa88347382194db828
TLSH
T17401BD17218E4E1D048015EF49B971C7C7BB882A2E9833C031C0D49AA78716A6B6AEC6
MD5 SHA1 SHA512 TLSH

Submit Download

system_diag.exe

Path C:\Users\Admin\AppData\Local\Temp\system_diag.exe
Size 7.7MB
SHA256 bc34dc5ff059183820f91d832b7e79b6eeb2562719c70f9525e5f0af2d0fa911
MD5 9521b91dd08f3fbc92a6cc0a98746ee5
SHA1 3e0d39818c860b4af0b372300e2a252add770185
SHA512 4348269f025f4cbfc65abe7712fdb5cd44fe0902737909786033890574778f6fb275484eecdc4fd598b2ae83a042b9338705858f02f3f4c30bd1440173f89219
SSDEEP 98304:oz66X5UdWUpT8VGWPBsNSpgF2NZ6KB1q7jvZiXEBQc+CRf:olXNMWPdj9sEXEnh
TLSH
T199868C43E2A290FCC16BC174835AA632FB72BC4945357ABB5BE0CA313E61F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 3KB
SHA256 2211ec4adc3611eab8030e8f445524088ad1b71ff45202e775c277e4a598dc22
MD5 85a44810c05307c5ccd7d6a3a9b17e8e
SHA1 e44032f7cc6af1b92a7e710cbaeb88aa3d77ea43
SHA512 e0ed39cb5338d27f132067bbdfb35056cea141c37e40cdfb6acc1dcb189c4457368936756d12709989708417fedbd771d2fbf2190ee901d37452eeedd3a5c6a3
TLSH
T1A3619322F6E65393F20970A58908097F9FDDBD27375858A233B46A81232105BDF6F0B0
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 518B
SHA256 ec8dc801933dc56dfd6d5bad13aff2818b1c8719a6f8626bb2ba550742e02c54
MD5 dd641173d0bb12857a294414ed1c5e95
SHA1 e0472f71c71b0c894330274b7190ee30ef88f09e
SHA512 f8a49f45a59aa31ef48ad14d2708a4254bd5265dfd2cad4472112c93c900bb6a47bf7d31114549ffa15783509cbde4af9ec534e8b65e0b81603bf5ccb781e235
TLSH
T1DBF02405BADB576B7020402B9A291C6EDFF4BC2B1E80680037ECA6A413155079F3A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 5KB
SHA256 1584634f94ced8de75ab1de8d980df9f36ede155da11fea4dc47b24f7abc3aa4
MD5 9958b409695cafd5ad46b186e14ace40
SHA1 00dcdbf5ae529c7d3bc7b2f0cab9ed750cbe10d7
SHA512 33f0c9012c41c741fd5eb68bae4d464097a2e32f2c7f6085563a00ca4f96515c594f19b6d74833492656e96d0a4cfe4fec7de11a1eb6cb8f6a89ed6350ec16fb
SSDEEP 96:oSUJQD0bHRdCmUSvGe4iM/DbUshDMiAhgHlG1KkT/5EanLj6vyi2BDLSIpt3Vm8n:JUJQw7RdCmUSvGe4iM/DbUshDMiAhgHE
TLSH
T12DC1C426F6E79353F20930D4CA080ABE9FDDBC673B5984E237A05A812321157DF6B4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 1KB
SHA256 8b4e49c6dac819508bd6c6570dcba49d9d3db4cda051386817b70b57b879d9b3
MD5 db59aa288e4359d3ef0a8726d60061c8
SHA1 a50bbd0b108eb5be016e2060313fc4cfc64d667d
SHA512 9532339bb942ff5bdc8070acf7d5b5f71aaf1216c966cd84640ef846803503c630d307d05a29786b54b37b24c590c3cdae974dedbf638cc1c4d4bd4fd8a6a13b
TLSH
T19821D715F6EA1797B10970A6D818083FDFE8BD2B3B68545237B86AD0231444BEF7A4F1
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 99df589019be4f1d29789a5af1c66212bd8a3cfbfb901d03d45d53ba43543d79
MD5 b0ae4e90cd62ba8e43c8f72e4a7c72e7
SHA1 0f7b6910b24a1446c9e2ae7ef3d2012b949bfa6a
SHA512 a4b8a2305879f1fd15c604701cf8687bceb6287b22c9d4ac786464bf076095908110bb0f81c51ef297a9dd53c3e4dc2c7a96546a3d386270c364c1d812a14205
TLSH
T1F841E325F6E613A7F11A70A19808093F9FEDBD2B3B68585233B47AC0231045BDF6A4B1
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 271e5a21948e70c46acf68c3cd1a89660080c46422ae1e21e749b66303f41520
MD5 ccd0da5f03e31debc3c57f485b32e58a
SHA1 fa4b8069fd8dc636a43e5fdcce4dd3bf3da79ead
SHA512 4f4d6fc42ded8831e50beb306351e7382b91ae44ac32bdb1edcb4670f6236b1eb4365545af5b9fcb11be33bdd5e5e77e32b7e6a0f3d45b9647f37da630ab7d71
TLSH
T1DC51C125F6E65397F21A70A19808093F9FDDBD2B3B68585237B47A80232145BDF7B0B1
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 3KB
SHA256 c24c66168e0295898e6f628b17866f2e8618f2f2f598faf32c8762634c50b04a
MD5 38dfded95180723c504516189eb729c4
SHA1 5c9593a411c5836ba3af6732a2ca418ef76f3f31
SHA512 212fa3873c30794f57501cf07b86715b6d787439a0d12b59287de07a236ab74acde112931a3019955638f19b5407f3150620f50f3a19126794e66bba4a6113fa
TLSH
T1C0514F26F6E65353F20970E489080A6F9FDDBD27376948A633B46A81232105BDF6B0B0
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 4KB
SHA256 83ab9ea0ef66ad0caa7a4ead31e4b48a6657f5fd2fd9835cdd197132f71714c5
MD5 ca037770c19a7adadffd9c07235b4c5f
SHA1 a482d0238b92490e5a4234df1d651d3e9f5051eb
SHA512 01bd3f6ff3a52ce4e652f6fa9decc27ce120f328102295aee7d2a7a16a0d44dc025449dafe25ee73a5c9b3f0721b6c6ca8ed308ec979f7b4edd54a34be77d011
SSDEEP 96:KRRdCmUSvGe4iM/DbUshDMiAhgHlG1KkT/5EanLj6vyi2BDLSIpt3Vm8eQSqcTDM:CRdCmUSvGe4iM/DbUshDMiAhgHlG1KkH
TLSH
T1A0817522F6E69353F20970E48A080A7B9FDDBD27371984A637B46AD12321157DF6F0B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 5KB
SHA256 e0951d123a3d4b4bb603553c24ffe25b68412fbc4308d1d1a8114ac8597a731d
MD5 62d3274094398b68902b3ca5ff94b857
SHA1 7772f3cc31b0d85f0d7744bb720fd5402858f52b
SHA512 f111b3377d531da9e7b255608da305375bc6f90f89fa1ff054dcba979d2e22f579b65ae4290e8a282b447f716a44a5a6ca382b5198d0a53878654b60adb76af6
SSDEEP 96:KRRdCmUSvGe4iM/DbUshDMiAhgHlG1KkT/5EanLj6vyi2BDLSIpt3Vm8eQSqcTD6:CRdCmUSvGe4iM/DbUshDMiAhgHlG1Kk9
TLSH
T11AB1A426F6E79353F20930D48A080ABA9FDDBD673B5984E737605A812321157DF6B4B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 51ff5cd67400b05595a024d0246a7ac04fe227e1737b8dc8b45fd1a5b9b81b11
MD5 640489fac71b33529e76ab090494d845
SHA1 f71e90d682f54fb5505e0e74b2eb5b1991bd3cc6
SHA512 e6ac234f0fe169d9589a6d2fe764395fabd038c1a785d6fc7c56cc1faca98ac6e992cd684ad3b26695d26aaf80764de4278c06de2d24313cdc213d2693f3cfae
TLSH
T1CB117525F2E61693F10A70E0980C093B9FECBE2B3768545737B46AD1230445BEF7A4B5
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 3da22ef3346d7cee5e504464dde67d7bba84a40954e9c139ba86bc71095869b2
MD5 266e32bc4b4bedcc3b3dc58fef9bb4cb
SHA1 93ca1d34618e215863e815cf7df1cc015960fa62
SHA512 0a470c8328335205cc83ecf9f135efc6f23c3e333bfa6bd870f47e0c470cc7aa03655c89215ece14ad1f5fdae4cce14d316f2b63fcef06bf65d73b7831bafdb6
TLSH
T13031AE25F2E61393F20A71A08848093B9FDDBD6B3768546633B47BC1231445BEF7A0B0
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 2KB
SHA256 eebdc9bd8fc027f1ad309af51e159225f9d994431e6f3ea0d37f87512d6cadaa
MD5 f37d473a3231017a5f6f8bfaf0065263
SHA1 b094b981c72565b3e7660182206de59ad647d092
SHA512 c1ef6873fcc5a86c5b5de9c534ebfa4cea59b15c511c9dfd4ab977996e70266e31b77af459d8be96ed6b5e35362b9891930591475a0e8728ec36ed11f95bf52c
TLSH
T176418A25F6E61393F20A71A08808093B9FDDBD6B7768586237B47AC1236145BDF7A0B0
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_early_debug.txt

Path C:\Users\Admin\stealer_early_debug.txt
Size 331B
SHA256 31e4c4d5d2afadd3af96a071139382dddfaa592a7ff204302bad5376f1f31065
MD5 8e05e951eb13334130e4a543e9474d35
SHA1 33e6322589ff92fe917c19649980bd300d120694
SHA512 b9858cb43d18381e445a77accad747886c91fc722a551b6310e4fca764d21713131a9b1f302c839ca985b5c4f67ef346cf92f8d87b0a10fec0c4389097649d40
TLSH
T1FEE0DF0499DF47BF3030402FAA245C9DDBE4B81B1E402A0077ECB650271190ADF2A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\temp_abe_output\chrome\Chrome\fingerprint.json
Size 868B
SHA256 f85bbfa3dddfeb8e3e44dce2741cd34252c162587e65cc5e7191b202e82ecc3f
MD5 5430aca9207182ba8d4f0d2fd3403a9c
SHA1 f6b6954fbdfc9be01581b09136c971a78d4f9f2a
SHA512 e4ce8e08e09425c5bd7a0b7b307378249e6ca677ef44389a14a855cb10278066d93f933a32c9ae38cb1d2d1480d0d774072e6f38983c56f000df590497ec3334
TLSH
T11411C903A541D0BF2932E048D270945736629F2E22B90C1337F7A81D185AB3E314AFA5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/772-8-0x00007FF68AD20000-0x00007FF68B578000-memory.dmp

Download

memory/5092-237-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp

Download

memory/5092-337-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp

Download

memory/5092-339-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp

Download

memory/5092-373-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp

Download

memory/5092-397-0x00007FF78CED0000-0x00007FF78D67F000-memory.dmp

Download

memory/5952-124-0x00007FF695C90000-0x00007FF696495000-memory.dmp

Download

memory/5952-398-0x00007FF695C90000-0x00007FF696495000-memory.dmp

Download