1697ef8be7322cd61763ef8a1fc727ea6f055265fb1f1022c003ced8679aa98b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe
Size 7.9MB
Sample260719-vs4basas3w
SHA256 1697ef8be7322cd61763ef8a1fc727ea6f055265fb1f1022c003ced8679aa98b
MD5 1d48ecd78be8fa4901f35d554dab215a
SHA1 1dacef3c1fe3bb700ade31353a226dd700b6130c
SHA512 b439a61cd9b38fbec7aea610db092344cadd9d5652755684740039644901f91979962a70781de990682a9e4b22707042c83f17f66cecc4a0ebd2c9ea9c8ca12e
SSDEEP 196608:l4QP6HkrMzvIa0oUF+zrmcP8N3EuU1ujlWrzg0pVbA:lyH9vBykiT3Ep1qlWngr
TLSH
T1E3862347F36391FCD269C075C35A6633FE327C4945367D7B2AE49A342E61E406A1EB08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51a-7.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1332-83-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1332-247-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1332-396-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51a-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1332-83-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1332-247-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1332-396-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51a-7.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1332-83-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1332-247-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1332-396-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51a-7.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1332-83-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1332-247-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/1332-396-0x00007FF643170000-0x00007FF64391E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 5 IoCs

pid	Process
2208	winsvc.dll
1332	system_diag.exe
2436	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
2024	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
5748	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2460	tasklist.exe
1740	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3024	cmd.exe
3152	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1220	timeout.exe
4716	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4408	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5748	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	winsvc.dll
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	winsvc.dll

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe
1332	system_diag.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	5748	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 2208	3452	2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe	90
PID 2208 wrote to memory of 1332	2208	winsvc.dll	93
PID 1332 wrote to memory of 2436	1332	system_diag.exe	95
PID 2436 wrote to memory of 1220	2436	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe	97
PID 2436 wrote to memory of 1220	2436	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe	97
PID 1332 wrote to memory of 2024	1332	system_diag.exe	100
PID 2024 wrote to memory of 5936	2024	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe	102
PID 2024 wrote to memory of 5936	2024	elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe	102
PID 1332 wrote to memory of 5748	1332	system_diag.exe	103
PID 1332 wrote to memory of 4408	1332	system_diag.exe	105
PID 1332 wrote to memory of 2460	1332	system_diag.exe	109
PID 1332 wrote to memory of 3024	1332	system_diag.exe	113
PID 3024 wrote to memory of 1536	3024	cmd.exe	115
PID 3024 wrote to memory of 4716	3024	cmd.exe	116
PID 3024 wrote to memory of 3152	3024	cmd.exe	117
PID 3152 wrote to memory of 1740	3152	cmd.exe	118
PID 3152 wrote to memory of 4676	3152	cmd.exe	119
PID 3024 wrote to memory of 5748	3024	cmd.exe	120
PID 3024 wrote to memory of 1220	3024	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_1d48ecd78be8fa4901f35d554dab215a_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\system_diag.exe
    "C:\Users\Admin\AppData\Local\Temp\system_diag.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe" chrome -o temp_abe_output\chrome -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe" edge -o temp_abe_output\edge -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe" brave -o temp_abe_output\brave -v -f
      4⤵
      Executes dropped EXE
      PID:5748
  - - C:\Windows\system32\systeminfo.exe
      "systeminfo"
      4⤵
      Gathers system information
      PID:4408
  - - C:\Windows\system32\tasklist.exe
      "tasklist"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2460
  - - C:\Windows\system32\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Local\Temp\sd_7f1747d5-8a3b-4152-ae47-1d639abe48d3.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1536
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /fi "IMAGENAME eq system_diag*" /fo csv | findstr /i "system_diag"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "IMAGENAME eq system_diag*" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
      - C:\Windows\system32\findstr.exe
        
        findstr /i "system_diag"
        6⤵
        
        PID:4676
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID K"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5748
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winsvc.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
Size 8.0MB
SHA256 eb07d9ac7f4c29f313df32e17efe4c6ec84ebc90204a9d2f7d67760974b21689
MD5 f33d6f54147ce085b6e8d6ea13f18862
SHA1 8611cee2b8fb24f788af3ada376d59320f18dbdb
SHA512 42a4b5b6b1f7b84c7ffd1ce57a499668774ee721f189532e30459f18695da4b4605add3bce439d831be283236e086252fa548eee21d0e38b9667b6f6cf27308f
SSDEEP 196608:Hv8VCVQJCAkoCMmqBwkiGvt1j8LRDwUszPSRidir+nN5:PM7JBbCpQf8ZwUszPSQkrqT
TLSH
T1CE86128D525D5714DE2E40F001A98CB580712B8DDE26FE773B1890727600BE7BEBBB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe

Path C:\Users\Admin\AppData\Local\Temp\elv_c46ab062-04b0-41af-a135-6e0bbde8da74.exe
Size 1.4MB
SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
MD5 7c9b8c74e6c7d2ac95a7e96eb9f44ea5
SHA1 38ed669edec250bb13c9bad53a79365e5985e61d
SHA512 15fbd4e99bb70def7d17dced847fb18e82a461580ac55413ec13042dbef7d9b7410c54f9301d5207a5fb3ca0cc3b5ef179debbb1dae5e4659068c7d0e34949e6
SSDEEP 24576:URQDAx+qUU8KTG7LMBFZE41m2yRwRkY9342P/dsD:URQDuwU1G7QBtoakY9I2P+
TLSH
T1AA65121BA6A400FDE1BBC274C9124A0ADB76FC4A4771E68F13944F951F27BA04E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd_7f1747d5-8a3b-4152-ae47-1d639abe48d3.bat

Path C:\Users\Admin\AppData\Local\Temp\sd_7f1747d5-8a3b-4152-ae47-1d639abe48d3.bat
Size 756B
SHA256 9ba3d872c95e5e44087817e4f8e82e7cc3632e498d3b5120e47b1ac4088f355e
MD5 a49da28597dadeba067f08d63ced8fe7
SHA1 438e4c4ba848bb61133a803cc0c2e770d63748cb
SHA512 0b728a500e03b9465612cfd1e90d60b2dd43e95d7be73ecf9c81b5088232f498df151e7b44fd1beb0e199bbb0ba415632981c0c0b24684fa88347382194db828
TLSH
T17401BD17218E4E1D048015EF49B971C7C7BB882A2E9833C031C0D49AA78716A6B6AEC6
MD5 SHA1 SHA512 TLSH

Submit Download

system_diag.exe

Path C:\Users\Admin\AppData\Local\Temp\system_diag.exe
Size 7.7MB
SHA256 6fa6e401088abaae31768210f171dfae8247a921b27dc9709a18cd76b72c0027
MD5 8a5b30594adcb841b680e7c20c567579
SHA1 25a9f25646804f35658e7b7b086a3296d89f7ad1
SHA512 95e4e2fc72e7f5731f9607d60c9ed707661ea7b324670b7232b951ad03dd6095d5794f246cbcb611d222ae5166514339350b653f4523a6ae9488814cd7e58cbb
SSDEEP 98304:BaPdYFoWRD0vPIiMalJG4QbJZHJWAmtIWyBMk+50:Y8kPFmpWAcaBRH
TLSH
T1A1868C43E2A390ECC16BC174835AA632FB32B84945357ABB57E0CB313E61F506B1DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 631B
SHA256 47951edb37bad20d6324f0d92df7ab4d53233dc580471b539c6749e0f8615569
MD5 0099f1bb26bcb4743fb24c3464d5e1c5
SHA1 af74e86ea4bca8269914601ee99359c623c06ab5
SHA512 02642c8236daf44ce781cad6c3706a9e6142dafa6409237751bbac787d702e1bbea1f1d00d90dee9f172afe3eea3d7fd1fbff82e1e9e82680d99677346ecec9b
TLSH
T15BF0491D2DE5D5BEE08050D7A23B4618CFF0B49B1F446A22B3CAEC9053439C72FB280A
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 6KB
SHA256 c797f7878d2a6d8094b108fd8c97cf25fd98750f61f474ac242c2bfea922972d
MD5 045b3b7cf022780fac657632c9d54686
SHA1 9c3c631f153befd6f0a8a579091e4eb59f45e283
SHA512 618220c20c0c74ef3d20c037f4df4cbb554fbf7c97ecb6d07ff9ac1fb733ee05916cbdd0a514307bab5e949012ca57ba4cf6d6a9a9f719ec43654a093ce4d70e
SSDEEP 96:oLFqG8GL/7Fw5/a7PP5pD4kZ8Mx+XhX3Vjx1MkhtRWAnRV9AthRSyXf21Ej0XUE:6LL7Fo/a7PhYDO4
TLSH
T136D1BDA97D64911AF18A72C3823A0B66EED0B4C777094837F7436595B31B0EB5FAF800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 1KB
SHA256 a047685ae31b1975c5cbb3b5145cc91a85391fb66a27ce7c0efe48441990d837
MD5 801a2f81a10317aea5d589fbd9946b18
SHA1 e4e653da330011b315b19e0f7e8e120a2696d888
SHA512 974359603943bb01ba7d19b9f1a1d78219f58c7d24749a32eaf807af8617505f8fbff325c922b35e6320bcf183994af64550ced9235e29bc147d2d2707478499
TLSH
T1F131C61DADA8D42FE1CA60C3903A0B22DEE0B4C77B585533B396A984930A4C7AF6E445
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 62488151f91b3440125dfe87470cb613ec225f1c3548547521b39169bd1b2aa7
MD5 2addf13588a393489855ff62dc4a0c87
SHA1 86784d57d033b4cfb009047d655df84855e4c2a5
SHA512 1df718aa9d3a67699d663036bcb06b9ae175902d94c64f4a64f0fb9039bea823b2f756d86d987e993c2ce53d35236d16c04903a728ff04b5185676f50312953b
TLSH
T18F41F52DADA4D52BE1CA60C3903A0B23DEE4B4C767484837B396A984935B4D39FEB005
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 5KB
SHA256 a638765bfa81fbee7006a3639ff1c659e50930f767c928cdc9bf9feb984cb679
MD5 073b28b52d99d256c7858bc54e1b72c5
SHA1 342c5382aae1da1cf3225f6b68f8698ea83e8e0c
SHA512 92547ee096e05d5bdde1667129b5741c7194d4a2cb7791ed6ce38ea6dff898a63371b73c9ad31486f34c0ebc77750ebbbed931912fc4ad0721e29cb93904ed21
SSDEEP 96:KMG8GL/7Fw5/a7PP5pD4kZ8Mx+XhX3Vjx1MkhtRWAnRV9AthRSyXf21Ej0v:ELL7Fo/a7PhYDOS
TLSH
T117C1BEA97D64911AF18A72C3C23A0BA2AED4B4C773194837F7436195B31B0EB5FAF450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 0162e8733af6767147fd7a66bf11f199310b34b4564a50e8269d881c099e5c3c
MD5 6faee3dfa36c92214d227fa10906b076
SHA1 20bdd5fbdc27fb938093b86f6d9fc6ea9f945d85
SHA512 4a503681cabf8ce7ebc32b504cb81202b397aecdaf5a498267b7203b7b49922f86aaa0f0c9ec75c7fa529e2d452b1c6a1d582c69fa95e315eb40d5f3f88d9de8
TLSH
T1A9119D2AB868D01BF1CA64C3903A0B339EE4B9D773584437B2566599830A0C7EF7E051
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 56755c0f0c27441ce5f624fb444dd0f9011f54d6b410405a98c6055312112313
MD5 64d584bea6a780e617bc94f2e8e07c06
SHA1 ee0ea7fa3b3e70f7604f365f8e9bfe1c9b563db8
SHA512 f0e6efcbe0fd3a59e1652263b0e123e5412ab87ddc96309fa57debaf4097c29adb7f0946c6e467f22119b7f60edfc054dc9e51169c5b5796872fc0cc2a79ee13
TLSH
T15731DF29B8A4A51BF1CA61C2807E0B339EE5B5C7B3584837B356A589935B0D39FFE000
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_early_debug.txt

Path C:\Users\Admin\stealer_early_debug.txt
Size 444B
SHA256 029aa8656bef11e0e3240662872c91eba39c83344e6ab6c05411696dd14344af
MD5 fd3f5bcebeb6072b9d9a47c3d85ea2e2
SHA1 db92267af2ca99044e4e8b3818a8f88325a4c7e0
SHA512 38acd4538c21ba1c9b29dcd4e6ec6e82b805fc2365ecb884f489748e201844043c5e4ad82ddc5049c08c27b8454f3824b16d477c2efc803d18bb172d4ee95aeb
TLSH
T1F7F0A71C5DDAD5BD919010D7E6365608CBE0B0871D456B21A3C5FD846312AC76F9384B
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\temp_abe_output\chrome\Chrome\fingerprint.json
Size 868B
SHA256 e7aba34c55e18be51949d595825015e9b6070cb3a0d60189e8204d15660fd8b9
MD5 76e2a5813fe4e5cae03f83c512d73a88
SHA1 a744304681aac6d64d6885487b33872c82a26964
SHA512 af71a27c1f8113ebb9ebb81e376fd9f122fd7f14466f3d1f8eef671fdcce27435e6ceb57d5259174553205034e01644c9597b14855a4ebe6fc6ed7dd77c275c4
TLSH
T10D118912A645D4BF3A31F148E270A85736618F2E22B60C1777F7A4181856B3E315BFA6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1332-83-0x00007FF643170000-0x00007FF64391E000-memory.dmp

Download

memory/1332-247-0x00007FF643170000-0x00007FF64391E000-memory.dmp

Download

memory/1332-396-0x00007FF643170000-0x00007FF64391E000-memory.dmp

Download

memory/2208-62-0x00007FF75D2D0000-0x00007FF75DAD4000-memory.dmp

Download

memory/2208-397-0x00007FF75D2D0000-0x00007FF75DAD4000-memory.dmp

Download

memory/3452-61-0x00007FF701470000-0x00007FF701C5E000-memory.dmp

Download