1697ef8be7322cd61763ef8a1fc727ea6f055265fb1f1022c003ced8679aa98b

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe
Size 7.9MB
Sample260719-vs4basas3w
SHA256 1697ef8be7322cd61763ef8a1fc727ea6f055265fb1f1022c003ced8679aa98b
MD5 1d48ecd78be8fa4901f35d554dab215a
SHA1 1dacef3c1fe3bb700ade31353a226dd700b6130c
SHA512 b439a61cd9b38fbec7aea610db092344cadd9d5652755684740039644901f91979962a70781de990682a9e4b22707042c83f17f66cecc4a0ebd2c9ea9c8ca12e
SSDEEP 196608:l4QP6HkrMzvIa0oUF+zrmcP8N3EuU1ujlWrzg0pVbA:lyH9vBykiT3Ep1qlWngr
TLSH
T1E3862347F36391FCD269C075C35A6633FE327C4945367D7B2AE49A342E61E406A1EB08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a2-8.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/892-100-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/892-273-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/892-364-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/892-378-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/892-422-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a2-8.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/892-100-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/892-273-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/892-364-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/892-378-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/892-422-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a2-8.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/892-100-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/892-273-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/892-364-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/892-378-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/892-422-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a2-8.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/892-100-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/892-273-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/892-364-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/892-378-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/892-422-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 5 IoCs

pid	Process
1780	winsvc.dll
892	system_diag.exe
2680	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
1396	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
2960	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2384	tasklist.exe
5040	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
2936	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2836	timeout.exe
2900	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4464	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	winsvc.dll

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe
892	system_diag.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	5040	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1780	1160	2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe	85
PID 1780 wrote to memory of 892	1780	winsvc.dll	87
PID 892 wrote to memory of 2680	892	system_diag.exe	101
PID 2680 wrote to memory of 964	2680	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe	103
PID 2680 wrote to memory of 964	2680	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe	103
PID 892 wrote to memory of 1396	892	system_diag.exe	106
PID 1396 wrote to memory of 3796	1396	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe	108
PID 1396 wrote to memory of 3796	1396	elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe	108
PID 892 wrote to memory of 2960	892	system_diag.exe	109
PID 892 wrote to memory of 4464	892	system_diag.exe	111
PID 892 wrote to memory of 2384	892	system_diag.exe	117
PID 892 wrote to memory of 2936	892	system_diag.exe	123
PID 2936 wrote to memory of 2468	2936	cmd.exe	125
PID 2936 wrote to memory of 2836	2936	cmd.exe	126
PID 2936 wrote to memory of 2080	2936	cmd.exe	127
PID 2080 wrote to memory of 5040	2080	cmd.exe	128
PID 2080 wrote to memory of 1984	2080	cmd.exe	129
PID 2936 wrote to memory of 2900	2936	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\system_diag.exe
    "C:\Users\Admin\AppData\Local\Temp\system_diag.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe" chrome -o temp_abe_output\chrome -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:964
  - - C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe" edge -o temp_abe_output\edge -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe" brave -o temp_abe_output\brave -v -f
      4⤵
      Executes dropped EXE
      PID:2960
  - - C:\Windows\system32\systeminfo.exe
      "systeminfo"
      4⤵
      Gathers system information
      PID:4464
  - - C:\Windows\system32\tasklist.exe
      "tasklist"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Windows\system32\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Local\Temp\sd_8345719e-030f-4745-afd2-d764da736de9.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2468
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /fi "IMAGENAME eq system_diag*" /fo csv | findstr /i "system_diag"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2080
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "IMAGENAME eq system_diag*" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
      - C:\Windows\system32\findstr.exe
        
        findstr /i "system_diag"
        6⤵
        
        PID:1984
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winsvc.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
Size 8.0MB
SHA256 eb07d9ac7f4c29f313df32e17efe4c6ec84ebc90204a9d2f7d67760974b21689
MD5 f33d6f54147ce085b6e8d6ea13f18862
SHA1 8611cee2b8fb24f788af3ada376d59320f18dbdb
SHA512 42a4b5b6b1f7b84c7ffd1ce57a499668774ee721f189532e30459f18695da4b4605add3bce439d831be283236e086252fa548eee21d0e38b9667b6f6cf27308f
SSDEEP 196608:Hv8VCVQJCAkoCMmqBwkiGvt1j8LRDwUszPSRidir+nN5:PM7JBbCpQf8ZwUszPSQkrqT
TLSH
T1CE86128D525D5714DE2E40F001A98CB580712B8DDE26FE773B1890727600BE7BEBBB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bm_f3eb93d8-8c82-4c8b-ab99-27b45f9fb5c7.db

Path C:\Users\Admin\AppData\Local\Temp\bm_f3eb93d8-8c82-4c8b-ab99-27b45f9fb5c7.db
Size 5.0MB
SHA256 1a976bd2e953b79750eec9cf3b3bb0dd594a63b90848cf50e8464dad8b23d323
MD5 d1b0d6d5e4433dfc8958b651187ae55b
SHA1 ae7dd876c455e52cf6b37de902db00646b049fc3
SHA512 0e26ea12dd6574bb30b49a152615f7f9b3bc6b3885c44daeaf1ed546e569f8836ab8676292dae7be3292bb4f2206b04e0786065d50c684c9790cd1d8a0fb5c48
SSDEEP 384:M8r54w0VW3xWpHKfKYK9KsK/a+FEQeACd4JG/U:rqVW3oVKfKYK9KsK/hFEQeACd4JG/U
TLSH
T18536231F7A205054C4EAA132EDE35F29287F701686377A933E94256D4DE0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe

Path C:\Users\Admin\AppData\Local\Temp\elv_2dbc35f1-da81-4fc5-a498-e83aacc42b14.exe
Size 1.4MB
SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
MD5 7c9b8c74e6c7d2ac95a7e96eb9f44ea5
SHA1 38ed669edec250bb13c9bad53a79365e5985e61d
SHA512 15fbd4e99bb70def7d17dced847fb18e82a461580ac55413ec13042dbef7d9b7410c54f9301d5207a5fb3ca0cc3b5ef179debbb1dae5e4659068c7d0e34949e6
SSDEEP 24576:URQDAx+qUU8KTG7LMBFZE41m2yRwRkY9342P/dsD:URQDuwU1G7QBtoakY9I2P+
TLSH
T1AA65121BA6A400FDE1BBC274C9124A0ADB76FC4A4771E68F13944F951F27BA04E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd_8345719e-030f-4745-afd2-d764da736de9.bat

Path C:\Users\Admin\AppData\Local\Temp\sd_8345719e-030f-4745-afd2-d764da736de9.bat
Size 756B
SHA256 9ba3d872c95e5e44087817e4f8e82e7cc3632e498d3b5120e47b1ac4088f355e
MD5 a49da28597dadeba067f08d63ced8fe7
SHA1 438e4c4ba848bb61133a803cc0c2e770d63748cb
SHA512 0b728a500e03b9465612cfd1e90d60b2dd43e95d7be73ecf9c81b5088232f498df151e7b44fd1beb0e199bbb0ba415632981c0c0b24684fa88347382194db828
TLSH
T17401BD17218E4E1D048015EF49B971C7C7BB882A2E9833C031C0D49AA78716A6B6AEC6
MD5 SHA1 SHA512 TLSH

Submit Download

system_diag.exe

Path C:\Users\Admin\AppData\Local\Temp\system_diag.exe
Size 7.7MB
SHA256 6fa6e401088abaae31768210f171dfae8247a921b27dc9709a18cd76b72c0027
MD5 8a5b30594adcb841b680e7c20c567579
SHA1 25a9f25646804f35658e7b7b086a3296d89f7ad1
SHA512 95e4e2fc72e7f5731f9607d60c9ed707661ea7b324670b7232b951ad03dd6095d5794f246cbcb611d222ae5166514339350b653f4523a6ae9488814cd7e58cbb
SSDEEP 98304:BaPdYFoWRD0vPIiMalJG4QbJZHJWAmtIWyBMk+50:Y8kPFmpWAcaBRH
TLSH
T1A1868C43E2A390ECC16BC174835AA632FB32B84945357ABB57E0CB313E61F506B1DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 3KB
SHA256 312829c00a1f2aabbbb8b5648f066d08d482f54347b9cf66f5b69e2349f1dc40
MD5 8a080fb780983eb25946628c763439b4
SHA1 7ccb703c51c53ce3a28fdabf50e8438d2c7d0b12
SHA512 5c0ce514c76f2119a13765b8e0c62edb7bb9a01782bb86eb627c2ea365170f4b87073aa1a618e24d9a84971487247b472b4dc177a71876fe7382edfb2ddc449a
TLSH
T10E719B6C3CA4D25BE68A70C3D13A0B569ED1B4C737086977F787A591632B4E75FAB000
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 630B
SHA256 7f1c8719e63fb8dc8e786c0cc7454b7a4efa0dcf2bec103f6aa795eecb6437c8
MD5 1eb98c9cc538098296ac77cee02f36dc
SHA1 6b8fbd2e57aa9b4df6e3fbe2f0fee613bd51f8d0
SHA512 e595f460cb9c9b5f36e6dc5a51b41f8453b98c813372cb1a5b00751fc43392def0470239da8f88c862fa3aa5dc15221900deaa058e36c43152a7ad9a19d56d0d
TLSH
T120F0F91D6CE9E5AEE8C640D7A23A5708DFE0B0471F447822B7C5AEA453129C72F72807
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 3KB
SHA256 9f491900f5bfa7181557b15fa6c649207796667801132bc0d43688589f91d97d
MD5 813544e6908e4b8784de3af0a3a083ee
SHA1 5232d53ae1bd0eefa0284b7ac9b872f814f569c0
SHA512 09f6ffe87d1d26db153a94c45586a050483b050befe7050e8943ac3cfa2135649077a3db0bc7e49b70c5cd28dfb9acef19af4690d642470a9e0766a82c8fee5c
TLSH
T13F716A6C3CA4D25BE68A70C3D13A0B129ED1B0C737085977F78795A2632B4E75FAB000
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 4KB
SHA256 03aef0c583b1da8cf1d20b9f0746296a7eab45ed038ea75d4f7cb1a05d79f7b0
MD5 29bf7af8093aead7a24a558d074b3740
SHA1 d26704cc1ecdc0505d40932dd54b8816174e3cb0
SHA512 a4d4725c0e96d54c0c025488df21e81d603fe3f0c5aaa376f7d9a7b4c970eec3d85f99e8a2da7df9d174dc9a45b1fa411f3ee055833d8b8c79adc33a7e6cd9cf
SSDEEP 48:oQ7shS2/2d2WmLa2dWgZmLAdWXlUriPlriPJ9F8usMLS5WDzNNbIA:oO+5Wcc9XOuNuhnwy9DF
TLSH
T1B0918B6C3DA4D25BE68A70C3D23A0B529ED1B087370859B7F78755A2732B4E75FAB004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 1KB
SHA256 dd193d5dfd48c2e36fe2beb47b4e17f44f9913fb851400c91a0c68fdd0f6ec8d
MD5 a42f986e7f6f559621ec3fb2ddbe73a6
SHA1 c256c7ceaae13910f9fbef243997dee6b0de1b18
SHA512 71cf062d20bb4cfdcd52d1a0a8eec68691516f90adb0daf14d027a27f966c75ac75ec13aa6a2222aae727c893cc7240ddc6c9c4f5a173dd064f9cc7f0bfdf9d0
TLSH
T126310E2D6CA8946BF58A50C3D13A0B01CEE2B4933B1C6A37F796DD90970A4C75FFA406
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 c769b94bf1304eccb4bcbeb9a0add93c497c31e982b1dc3d4bd5e15c58587c77
MD5 280fd3d3d14d996a8799ff3bf3eb840a
SHA1 2cc268f634c5564f415c5a7215943d18da6109c8
SHA512 15736b5a0bc69cc025447a6862297e4d318c63b51eb822fb2c447209293cac21d554f5b548cc97a6f6e5f3f28646ab542a99800049978b9d3dfb434de295df57
TLSH
T18051E02C3CA4915BE68A60C3D03A0B669ED5B1C737086937B796A9C1672B4D75FEB001
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 3KB
SHA256 7df6a016eccaeef0e06fd40e75560ef9dd1b41d5d6803dcc0f4a9aba52610b7f
MD5 33bd6d48895247befba0e8b88585ba58
SHA1 7c559c9b40516ea03ec94db7289889a1ff9250d9
SHA512 a5408dd069e6b5e83fda0274b58744a4c39d76c310e58a9b97019484c1e475bdb0b85b29709b0cb83f80a16df8975c7e551e6e75c6914df0288d8e578312a8a6
TLSH
T10951886839A4D25BE68A70C3C13A0B539EC5B5C733085977F39795A2632B4E75FAF000
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 3KB
SHA256 fa1310067ab67b314b824780bb3cbbef370fde4f603cfe5982a1070e13f47902
MD5 72db6f345ac84709799c7c1e3f118656
SHA1 3cb1c6821590b307e1eeb6f5f1a6fde0f0314b89
SHA512 22e9b9cb0a29275dd38ea7b419a33c36a7887e89d5c07cafebc0ca5b0b0084e863164f6f820b880e9ed7825f7d55d9330c07558921ce2fc52bf1e945c32c77ee
TLSH
T1ED6157A83864D25BE68A70C3C13A0B539EC1B5C7330859B7F79754A2632B0EB5FAF000
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 4KB
SHA256 bafda9430581669f336e8dd606665d01d076f4fec05916f49633046840f20151
MD5 3d87b2af9e7116c81a9ebb9ef74623f0
SHA1 bb11ba0a99a39ce31d3eb142fda55518d0c9e22c
SHA512 4564d6e4c288c325a39d1d83f326a237dbdf2d9126f093e4e39ca188fc268f112be87fc74c308f5d9c8f0d01d98772de6ffe581294777578c230fb7759b9ba1f
SSDEEP 48:Ku2WmLa2dWgZmLAdWXlUriPlriPJ9F8usMLS5WDzNNbIzwcrNI:KTWcc9XOuNuhnwy9D1qa
TLSH
T1DF916AA83D64D15BE68A70C3823A0B529EC1B5C7331859B7F78754A2732B4E75FAF014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 7041c328a5a5e040b91cdc77489b5dc6f2eabb7bc1052ec10be688022302f6e3
MD5 759df076ac0c9300d92a113830a2f38a
SHA1 1edf239749a28839b0522eddca568a4d8d6dd1bc
SHA512 3a1b9770f4352a437525a4efb4fc114d222194f24a16c1be48249a21b433409e40f9f0325caedc4d8c7392399335b16d90219d159af9c7b3170ca676f388aaa0
TLSH
T19911AC297CA4901BF58BA0C3C03E0B529EE6B6A3331C5637F796C891970A0D75FFA014
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 2KB
SHA256 d70a0d1cdfe40abc1ef60ededa12f72361551357aa7a1238606728085f90c728
MD5 c3d77a83cf07d9e43613a95a1e6d12be
SHA1 59c09a7434976e514b461e8b76d7009b1faee557
SHA512 bebfc6681a588e86e399ced7e16021e9adeb35a417c072b412792c7abe00da85dd56ad07b6f5e3ad15ed2739aa2a7c97554af95420f81eddfb00611c2e398e0a
TLSH
T13D41AC2839A4915BE68B60C3803A0B639ED6B1D733085937B79294D1672B4D78FFA014
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_early_debug.txt

Path C:\Users\Admin\stealer_early_debug.txt
Size 443B
SHA256 cec6958d463da89957674cc6a9febb1d24d419bd4b08d71d8ae6d23ca331751b
MD5 e95670c37a608ef9364ca2187ac19a04
SHA1 f891db609411af82d29a5eac0a2c22d2d9b352a1
SHA512 18b077236952a44de88f272c941772d3cd10e8a4d9de2bb54833747518075507542ff283836896f5f531cefff62331cf3d7c3ebba2569f7553cf6ef33df5690a
TLSH
T127F0A01C5CEAD9BEA99000D7E6369608DBE0B0471E517921A7C6BE946312AC76F13843
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\temp_abe_output\chrome\Chrome\Default\cookies.json
Size 349B
SHA256 e94555c7a6f0da125a6f542f8be713eaf94a46f0bb384f5c257b567a9623c96a
MD5 d3edd17b05444b60507b610e88fda1a6
SHA1 f0f5972cb301d2103520124c577a6f8c9e2a5a0e
SHA512 128e44083f92be12699e7dad798de34e4e9e8a05fef501aa91a340e7d425e4abe56cf913bcba18bae6622849a79af8242ae4b64a420e040862c742ea1e973ae7
TLSH
T129E0689B73A28CA28811AD35DD2016A23F20629A901ABCC556A688E9609484A62204D2
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\temp_abe_output\chrome\Chrome\fingerprint.json
Size 970B
SHA256 479a64961e036a0e29822b7ff25baee4c45be2d2f5b5a8bcd74184af8661f3ad
MD5 81ccdcecb665f7a269732d2395a8579e
SHA1 93ac0adb25d5f0895d144e5e6470a1c29ad3a09f
SHA512 35fdfa055bedf8867f7da51bf500ac1d9401980c42114b22df41aff84b129d4d07a52c7862c3ca80e774105f6081586c51baaab3a965207b86b7915dce15bc15
TLSH
T183114052A805C4BF2871F018D63095573A714F2D31B90C1333FB6428181A73E214AFA2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/892-378-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp

Download

memory/892-273-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp

Download

memory/892-364-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp

Download

memory/892-100-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp

Download

memory/892-422-0x00007FF7A2840000-0x00007FF7A2FEE000-memory.dmp

Download

memory/1160-61-0x00007FF7FA430000-0x00007FF7FAC1E000-memory.dmp

Download

memory/1780-62-0x00007FF6A0B40000-0x00007FF6A1344000-memory.dmp

Download

memory/1780-423-0x00007FF6A0B40000-0x00007FF6A1344000-memory.dmp

Download