d9f33c73f3daab5dd2eb0f2066944253a7eb20e79562d39d0a6be21994e56927

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_bce5b1b7ad79026afe362dd9b12f83bc_akira_quasar-rat.exe
Size 7.9MB
Sample260720-a1zymacy8x
SHA256 d9f33c73f3daab5dd2eb0f2066944253a7eb20e79562d39d0a6be21994e56927
MD5 bce5b1b7ad79026afe362dd9b12f83bc
SHA1 756a62425b3541177c04e7c48de4ad6eaa70e561
SHA512 cddc1289302e7b1676423dadd5e7921b08ff32ff8dcf19f2d938cd939abbd6d86e30f4444bcace5e3aef9f4fecf3a494c94c191419d87f66767633eeb62c9ed6
SSDEEP 196608:aYwlcYZ0liwxd3WlKXlu43M0GHJukzdjqf+9T/cpdJwCLv:RCcI9cGlKy0GH4iH0p0Cb
TLSH
T10C862347F26381BCD126C0B4539AA273FF72BC9A11327EBB17E496312E61E406B1D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 7 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51b-7.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-240-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-322-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-335-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-345-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-379-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/6044-403-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51b-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-240-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-322-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-335-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-345-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-379-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6044-403-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 7 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51b-7.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-240-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-322-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-335-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-345-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-379-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6044-403-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 7 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c51b-7.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-240-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-322-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-335-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-345-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-379-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/memory/6044-403-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 5 IoCs

pid	Process
4864	winsvc.dll
6044	system_diag.exe
2704	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
3204	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
1056	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5740	tasklist.exe
3748	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4668	cmd.exe
4772	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4332	timeout.exe
1624	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5712	systeminfo.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	winsvc.dll
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	winsvc.dll

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe
6044	system_diag.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5740	tasklist.exe
Token: SeDebugPrivilege	3748	tasklist.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4864	3656	2026-07-19_bce5b1b7ad79026afe362dd9b12f83bc_akira_quasar-rat.exe	90
PID 4864 wrote to memory of 6044	4864	winsvc.dll	93
PID 6044 wrote to memory of 2704	6044	system_diag.exe	95
PID 2704 wrote to memory of 5464	2704	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe	97
PID 2704 wrote to memory of 5464	2704	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe	97
PID 6044 wrote to memory of 3204	6044	system_diag.exe	100
PID 3204 wrote to memory of 5756	3204	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe	102
PID 3204 wrote to memory of 5756	3204	elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe	102
PID 6044 wrote to memory of 1056	6044	system_diag.exe	103
PID 6044 wrote to memory of 5712	6044	system_diag.exe	105
PID 6044 wrote to memory of 5740	6044	system_diag.exe	109
PID 6044 wrote to memory of 4668	6044	system_diag.exe	115
PID 4668 wrote to memory of 5856	4668	cmd.exe	117
PID 4668 wrote to memory of 4332	4668	cmd.exe	118
PID 4668 wrote to memory of 4772	4668	cmd.exe	119
PID 4772 wrote to memory of 3748	4772	cmd.exe	120
PID 4772 wrote to memory of 3664	4772	cmd.exe	121
PID 4668 wrote to memory of 1624	4668	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-07-19_bce5b1b7ad79026afe362dd9b12f83bc_akira_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_bce5b1b7ad79026afe362dd9b12f83bc_akira_quasar-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\system_diag.exe
    "C:\Users\Admin\AppData\Local\Temp\system_diag.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe" chrome -o temp_abe_output\chrome -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe" edge -o temp_abe_output\edge -v -f
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
      "C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe" brave -o temp_abe_output\brave -v -f
      4⤵
      Executes dropped EXE
      PID:1056
  - - C:\Windows\system32\systeminfo.exe
      "systeminfo"
      4⤵
      Gathers system information
      PID:5712
  - - C:\Windows\system32\tasklist.exe
      "tasklist"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5740
  - - C:\Windows\system32\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Local\Temp\sd_6770c12f-c5a8-4c7c-9443-13e8e76100ce.bat
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5856
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 1 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /fi "IMAGENAME eq system_diag*" /fo csv | findstr /i "system_diag"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "IMAGENAME eq system_diag*" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
      - C:\Windows\system32\findstr.exe
        
        findstr /i "system_diag"
        6⤵
        
        PID:3664
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winsvc.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\winsvc.dll
Size 8.0MB
SHA256 eb07d9ac7f4c29f313df32e17efe4c6ec84ebc90204a9d2f7d67760974b21689
MD5 f33d6f54147ce085b6e8d6ea13f18862
SHA1 8611cee2b8fb24f788af3ada376d59320f18dbdb
SHA512 42a4b5b6b1f7b84c7ffd1ce57a499668774ee721f189532e30459f18695da4b4605add3bce439d831be283236e086252fa548eee21d0e38b9667b6f6cf27308f
SSDEEP 196608:Hv8VCVQJCAkoCMmqBwkiGvt1j8LRDwUszPSRidir+nN5:PM7JBbCpQf8ZwUszPSQkrqT
TLSH
T1CE86128D525D5714DE2E40F001A98CB580712B8DDE26FE773B1890727600BE7BEBBB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe

Path C:\Users\Admin\AppData\Local\Temp\elv_d8b690a3-b8c4-4c25-811c-12258633c95e.exe
Size 1.4MB
SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
MD5 7c9b8c74e6c7d2ac95a7e96eb9f44ea5
SHA1 38ed669edec250bb13c9bad53a79365e5985e61d
SHA512 15fbd4e99bb70def7d17dced847fb18e82a461580ac55413ec13042dbef7d9b7410c54f9301d5207a5fb3ca0cc3b5ef179debbb1dae5e4659068c7d0e34949e6
SSDEEP 24576:URQDAx+qUU8KTG7LMBFZE41m2yRwRkY9342P/dsD:URQDuwU1G7QBtoakY9I2P+
TLSH
T1AA65121BA6A400FDE1BBC274C9124A0ADB76FC4A4771E68F13944F951F27BA04E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd_6770c12f-c5a8-4c7c-9443-13e8e76100ce.bat

Path C:\Users\Admin\AppData\Local\Temp\sd_6770c12f-c5a8-4c7c-9443-13e8e76100ce.bat
Size 756B
SHA256 9ba3d872c95e5e44087817e4f8e82e7cc3632e498d3b5120e47b1ac4088f355e
MD5 a49da28597dadeba067f08d63ced8fe7
SHA1 438e4c4ba848bb61133a803cc0c2e770d63748cb
SHA512 0b728a500e03b9465612cfd1e90d60b2dd43e95d7be73ecf9c81b5088232f498df151e7b44fd1beb0e199bbb0ba415632981c0c0b24684fa88347382194db828
TLSH
T17401BD17218E4E1D048015EF49B971C7C7BB882A2E9833C031C0D49AA78716A6B6AEC6
MD5 SHA1 SHA512 TLSH

Submit Download

system_diag.exe

Path C:\Users\Admin\AppData\Local\Temp\system_diag.exe
Size 7.7MB
SHA256 6fa6e401088abaae31768210f171dfae8247a921b27dc9709a18cd76b72c0027
MD5 8a5b30594adcb841b680e7c20c567579
SHA1 25a9f25646804f35658e7b7b086a3296d89f7ad1
SHA512 95e4e2fc72e7f5731f9607d60c9ed707661ea7b324670b7232b951ad03dd6095d5794f246cbcb611d222ae5166514339350b653f4523a6ae9488814cd7e58cbb
SSDEEP 98304:BaPdYFoWRD0vPIiMalJG4QbJZHJWAmtIWyBMk+50:Y8kPFmpWAcaBRH
TLSH
T1A1868C43E2A390ECC16BC174835AA632FB32B84945357ABB57E0CB313E61F506B1DB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 3KB
SHA256 f142a845ef2007e00dded4c1ee53c67d4d73ec20c762eafbd6fe1e6fbda0efca
MD5 b81db2f42b9e8e914556f73e97813df9
SHA1 eebea2c8d9f19a6a26527e3984074944fbb795d0
SHA512 abb026c3e2bd86b0c405bcc674d3c40e5463cf36b2e38a2e9d1fd8501e75d1cadb09a9bb0813968603d1166d3d934f97b0dac7ed3a5fa51051c1608b9a7c12da
TLSH
T115716E2197F5C952DA096085C1516E8EBEF7FC0F3F985822B78458852B6345AFFFB011
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 631B
SHA256 b846baf7d2caafb6d55be96060a133e9afa33d68974e7b2a42481bdf69e3708f
MD5 8f437fbbc3a338d8524823791222e969
SHA1 0150a7cbb3864601adadccbf91569327767a78ad
SHA512 d6b0674a4cc8526c1b3bd338d3da2106f964c90e895f1a3080849ccad44f72f4ab42e538b9b64b367413b84e2657bf6f94d474dd65ee0647cea826811f991185
TLSH
T176F0F4258AF5DDA655554057AB236C5CEFF1BC0F2EC56D0077C8ACA01B12A46EEBE803
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 5KB
SHA256 1ca319236135fa90316ddd54b575b830ea7e3f14bb17eaa896654678818b0e92
MD5 7be4aa5d7ff73c34330f2d71f6501a59
SHA1 b76f211761ae0bc644fccb7b3fadb52f5745b382
SHA512 ad83aacdc812a363769bf71a08422873930b62479a2f17c581299a720a457901edd1a8d17bb39eaf8f988b6f933c22ad2a7c777e7e25996c0d80e5c127748da1
SSDEEP 48:oP4hE2t2xwvYS2lHg1lZN5g9yy8RE8H+odo34hZ+5UoI2wgd6:oR46wvYJEFeKS8HS4YUo6
TLSH
T11BC1A025A7F9C522DD0960D9C1402EDABEFBBC4F3FA94862B74068912B52056FFFB411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 1KB
SHA256 bd1555bfc686bfbbb30d91e63b063f25d2332e1a7432ae81327264a51b57228b
MD5 3839ea9eff78832affdf4689a514a634
SHA1 973b83754f6f5cb1efb9957906fd23c0e292fd5e
SHA512 c3a172b326c0666a8912c3c7b3ada2be101db19e8120f3474b5419c85bf1edb8a4e9e7583825c156d9f0ba223a9e44a94c7e02bc047ffa483a5744dbbb14ca96
TLSH
T10831E225C7F48C23D94A50C2D211A99DFEF2BD0F3FC85812B79498901E96986EFFA412
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 8cc429641fdc9ffaf96dc6c857c2af1daada6c7b87a8cb682a88db39a2a2a07c
MD5 78f74d64115992082323f6662c29e0ef
SHA1 8b3e4adf0a5e805739d71ada6542e68f966c5a21
SHA512 450ef6918ee30ef9d8eb470f4c9aa8c3391407f74225cb42ede6700004be98d17f0eb6b0f17f59ea65f2d2e4ea832047ac24be3d517a122c1d1d2accaa8d5b88
TLSH
T1AB41FE24D7F4C963DA0A60D1C290699EBEF7BD0F3F884852B79458901E53856FEFB402
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_debug.txt

Path C:\Users\Admin\Desktop\stealer_debug.txt
Size 2KB
SHA256 27e8ed657a97574e7c4c53d54e2be627d4d7e2b6d459677ae33628cbba97f4cf
MD5 44601daecaa36dab9a26ad18af7b6c81
SHA1 0dc89916415ff4effdd2d207a330629c9006dae5
SHA512 73c054626dda22ee4314737c4a9d3ba2e0c3d24cf7f0d3a1f18f44bd53f9efc58196594aa5c941776c347715731805d243d5b25ea415b559437e8a9a4946d9be
TLSH
T10951ED2497F4C912DA0A60D1C1906A9EBEF7FC0F3F985812B79458802E63456EFFB402
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 3KB
SHA256 1f064ae449b0239bb352fa7542dc22d33f641f5af274f4b9de21e7d20f8ed451
MD5 36209cf2dc506bfb35305eb758c92997
SHA1 62c0a3ba085d8f84b13ca643c95ea4f63eeb30bf
SHA512 1c97913c2250661ed9c0d65663d0636bb19534ebffd86aedc0fe904f8fb91baf3e1ff69f036aa1898bd8b89ffe9bf9eab8e0830031dbbcada83e8096aa7d2be5
TLSH
T15F612B21A7F4C912DA096184C1406E8ABEF7FD0F3B985862B75458862B6346AFFBB011
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 5KB
SHA256 42fd1ab9a4f2063dd0b14369aca056a8c4e09b89fb7e0fbda1efdc713a11ec26
MD5 bd34327ef9f2b9157273ba246638cd02
SHA1 f2367b1edc58b14fe8ddea845834868cc26ea5da
SHA512 a9ce688ead8f9223b49626b781e3b744f5211c07b3321e60aab503a008d3f8469408d58c1381ae008a63a97a7f2a8fd58e7de91a847e3d9d9b034bc096799324
SSDEEP 48:KkwvYS2lHg1lZN5g9yy8RE8H+odo34hZ+5UoI2wgd6:KkwvYJEFeKS8HS4YUo6
TLSH
T113B19021A7F9C512DD0A71C8C1402EDABEFBBD4F3BA94462B74068912B52066FFFB014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 7e38a4ed4d12bd809ea6c88eaaed8094fd68913a086ebd23e2614b58012b713a
MD5 764ab4c927cff95c00e4b93012208e97
SHA1 7453b7dec6cf239a24c78bff85e9f2d0f8494ffe
SHA512 7f946019f410b77de609931d60451776432db136571f9dfeed22453e1fb5a9e74be90e9df1354c367b66d0efbf0cec0932e1fc07ad7dcde434c67a585cd3c43d
TLSH
T16811AC21D7F48C13D94A64C1C105A9AEBEF7BE0F7F984457B7A488910E86486EFFA011
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 1KB
SHA256 ec547b288c50f7fe5f83d4f75144a2512fb2f50432c7653ad9a01d89f5890bca
MD5 661bc884516fd125fb829aafbd73694b
SHA1 0a5d85518167ab2d62bec0c222a2c034645875e5
SHA512 d386b0092c566e61ee2b9d53083e66d6a4e869b43137be51af64593bc1b248b96e842e33696dd811299c940590f2094b91a4e685b115ed2a03191ffb06b491f8
TLSH
T10531ED2497F4C913DA0A60C0C190699EBEF7BE0F3B984856B75408901EA34A6FFFB016
MD5 SHA1 SHA512 TLSH

Submit Download

BACKUP_LOG.txt

Path C:\Users\Admin\logs\BACKUP_LOG.txt
Size 2KB
SHA256 613757fc7e697a4051fe186d98e97378aeefaf470287ce81352d19e6b53cd023
MD5 7e812145dc48793b13cf540ab428b044
SHA1 0feb2849df500f17a50222a4f46531921407c85e
SHA512 494b1ba37311192c7f014bfd0bff0a6ca58b731a1bf355794af675800922151781f637da4de4331d62645bc045d15a3337c3df741854ed90b52ff3c5f17fc456
TLSH
T182418D2497F4C913DA0AA1D0C1906A9EBEF7FD0F3B984866B75408911E63466FFFB012
MD5 SHA1 SHA512 TLSH

Submit Download

stealer_early_debug.txt

Path C:\Users\Admin\stealer_early_debug.txt
Size 444B
SHA256 74d13e65693a6fa6f6108dd6914b8771c37012645f237a5312b35afa7ac6751e
MD5 f33ec83c9f9e41ca6a2c4cfc2b44867b
SHA1 7b7e1bb44970fa8ccedd09ab6b1b91eb6b5ebf51
SHA512 cc16d8c044ce9aa87ec62a19320a126500a5b18ea3551c022a686a132c9235a2c7f3117edcbe8e150d796c022c9851b4e812b0ab524d04a8b4dd4bd7b9df03ef
TLSH
T13AF0A7148AF9DDB955500017EB226D4CEFF1B80F1D817D0023C4BD842B52A05EDBF843
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\temp_abe_output\chrome\Chrome\fingerprint.json
Size 868B
SHA256 8ffe7b2c5c33de7917e5771bafdacc8705f0ffaba2b9cb0c9510e9496f578782
MD5 a7beeb38311f7f17386a76f84d940139
SHA1 618b61025a15406ad69eea7de5d34f58c3ed7ada
SHA512 30f8c397307a4177c95a884cdeef6fa4a26f736c0e6ef8ea69a3d808228cce82ea5ced701c2be9123da1923709ddd8c7590f67e265a361d2138592c8ea7050ac
TLSH
T13711C912A505D4BF2931E048E270A8577A718F2E22B90C1337F7A40C1856B3A314AFA6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3656-126-0x00007FF786480000-0x00007FF786C6E000-memory.dmp

Download

memory/4864-239-0x00007FF7F5D00000-0x00007FF7F6504000-memory.dmp

Download

memory/4864-404-0x00007FF7F5D00000-0x00007FF7F6504000-memory.dmp

Download

memory/6044-322-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download

memory/6044-335-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download

memory/6044-345-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download

memory/6044-379-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download

memory/6044-240-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download

memory/6044-403-0x00007FF67FB50000-0x00007FF6802FE000-memory.dmp

Download