bbad922cd7ad33f2592c001d0956491d873ed2270766e0f0f81c8adc076c8307

Analysis

max time kernel
298s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.3MB
Sample260819-amka1stdlg
SHA256 bbad922cd7ad33f2592c001d0956491d873ed2270766e0f0f81c8adc076c8307
MD5 c24fe5ae59d1369775d162697d52e370
SHA1 dd2387171456dcf0a516d546b9afcddead39868b
SHA512 bafb65f8fd6ae7335b5e189abb419de1cbc427f4a6c20cb6e4c70f876051ce02ed119ba7e3da6afbe47de38c93a43017ea9df6847c95c8ccff909fa252db0f6c
SSDEEP 49152:bUHBjeYsjkZ6oOW/iXDML3GjoO/Qfidly7ZcK8I:bGByxW/iXIOQfiuZcK
TLSH
T142B5234342D8A028E1766736CDB2608712707D9B6BB8A5CF3B94BA0A3E73DD1D539707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3128	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
692	AutoIt3.exe
8	AutoIt3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 8	692	AutoIt3.exe	83
PID 8 set thread context of 780	8	AutoIt3.exe	84
PID 8 set thread context of 3936	8	AutoIt3.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3388	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
8	AutoIt3.exe
3128	powershell.exe
3128	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
692	AutoIt3.exe
692	AutoIt3.exe
692	AutoIt3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3388	792	Setup.exe	80
PID 792 wrote to memory of 692	792	Setup.exe	82
PID 692 wrote to memory of 8	692	AutoIt3.exe	83
PID 692 wrote to memory of 8	692	AutoIt3.exe	83
PID 692 wrote to memory of 8	692	AutoIt3.exe	83
PID 8 wrote to memory of 780	8	AutoIt3.exe	84
PID 8 wrote to memory of 780	8	AutoIt3.exe	84
PID 8 wrote to memory of 780	8	AutoIt3.exe	84
PID 8 wrote to memory of 3936	8	AutoIt3.exe	89
PID 8 wrote to memory of 3936	8	AutoIt3.exe	89
PID 8 wrote to memory of 3936	8	AutoIt3.exe	89
PID 8 wrote to memory of 3128	8	AutoIt3.exe	94

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /73465298ehfjshdf87934
  2⤵
  - Gathers network information
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Sheep.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { try { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\result.zip' -Force -ErrorAction Stop; exit 0 } catch { exit 1 } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Edge\Cookies\Default\Network\Cookies
Size 20KB
SHA256 f888b4bc3ad8f590dcf9d4506ef62a3e2515a54c90b1b19b0163a7e07c0f06fe
MD5 1769464cb60ce0a9ff2c4cc045fd8f1b
SHA1 f445a1760302fa064df6d5e77f12fb0385cf15d4
SHA512 60612b0f7ccdf021833e3ee47d1ed79aa84d0778f2fccc13d6f77938b86235331731e2211003427d2c51af536bdc2be8690c858d946fad6ac508554756ba65fc
SSDEEP 24:TLJLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBY+opwOKOJn6BR4W2+AwH:TtLopFMatSaw/auUOt8BY+opwp/7AwH
TLSH
T18792654E5F30A220D0B04B72DDD141A72E7C111D8377B65ADD1460F38EA269FF1160A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Edge\History\Default\History
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Edge\LoginData\Default\Login Data
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Edge\TopSites\Default\Top Sites
Size 20KB
SHA256 20985daa9b399a1a4c8cb0f7b8de8dc2d708236f2effe8b175bf0b3a67579568
MD5 3e76d9cac1f9ae7467eda94c260c2741
SHA1 79499f9edf34efae2559b6bb769d6f4b8890c959
SHA512 3b4427622b43c653dc72173848df6d2d37f5e0c5b001e49c97bdf6678ebb951b7dbcc50c6de30cb4c6677f238c5eabe52a0137975847fd51905c3ec3d6ab6d0e
SSDEEP 12:TLiNaCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiQCZwE8I6Uwcco5fBtC
TLSH
T1E3927D8B5F246832C8B5473A92DBC2D44E7BD51DC781AFD1419858619ED0580519A466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Edge\WebData\Default\Web Data
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Cookies\Default\Network\Cookies
Size 20KB
SHA256 2be7e370a0f5d742e3653bd98e89a99cd8ddc9204dc6368949c7c77b0840269f
MD5 0cd228272ed3bf453a44291cfb8c0198
SHA1 93c9b87f61426d43f33bf3bf848ca5a2f868f33f
SHA512 3f8e4252c6c4144dd6e8381bc0c863b6962f08c079c743b363b6bb02687330752f892b136126820fc73150a7bdfb02f20a3e01a09ad2e9c152d433108ead9d18
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5UoTi81H4hinreVdfLqltwQ:TeW9aw/aHLopFMavU1iBQNHZYcreXfL6
TLSH
T13492EC8F1F303620C4F88736E8D208A62E7C211D9313AA89ED1064F29D825AFF1065E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Extensions\Profile_0\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 68B
SHA256 d96b3d82465808c49ce3c948745074d143504d00f44a9ff3b26a42f0c88e1f61
MD5 f67672c18281ad476bb09676baee42c4
SHA1 fb4e31c9a39545d822b2f18b0b87ca465e7768c9
SHA512 ff37752848af570cb284f5fb65837472ddf9941992fffceb049a70c36d858c37e4e87016176b4e62d0eda63c235ca742411947d50d163cbc7823c50a734f0898
TLSH
T10CA002A3BB121111D502D9B8701067969726C521024B55D1450901355AC9694351A199
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Extensions\Profile_0\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Extensions\Profile_0\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 401B
SHA256 9589a0e7dd81fe1b7626d65b33aa3715b15bcf8e694e19a815aa0c673a05f0f0
MD5 4f8cc75bc42ded15dc4718ba090aadbf
SHA1 5c7d99ac698dd683375765643f61648098248d22
SHA512 d73f32a5ee07339da4c86269939b9e2a75989c83fc769a8281c9b53c22951bbf7f0b65af616c3c9075a494279789843634d4b224703019fec129326faa8bb4ab
TLSH
T10CE02B4A3CCE9EADDA84A077D370C70FCBE0344FA2CD36238789D868109210493C1756
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Extensions\Profile_0\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG.old
Size 363B
SHA256 287e4ac777cbe3f51cde119be524a834060e32dbacdaa16734f8c324c95efada
MD5 9ad4604e2b03e95cbbb33f20f283d529
SHA1 20bfc3b8542ab24a2742813c61472865cc72e28b
SHA512 b5f3e423e70df423b76b6b7703fcf1868ecaa4cfd13f638ff4fcd4d58232d1af408c9f591963f9f365c8fa27e50b4618d7931bb1022406dd735d78a6b02d5858
TLSH
T1C4E0680978CA8EEE158880B6C3218B1FCFE0700EA2D976168B8DDC140096188A6D0642
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\Extensions\Profile_0\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\History\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\LoginData\Default\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\TopSites\Default\Top Sites
Size 20KB
SHA256 46ce0815c17cf69ac6ea71b0b62f6bffdcf2f186345c902db74590aa1f6e0b48
MD5 8f968e2e8336299c9c37f0f1c9303d98
SHA1 2285ffa966112b53f56283949ec2219174358f16
SHA512 e12b9b7274bff0334e8298f12b81d446c40f3eba0e75b500c74a46d195f409b7219df160a850c92d6389f8c74ebdb200b5c87325a5a9dc4e20cff0f395c3d466
SSDEEP 12:TLiNaCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOS2Rccog2IccogL:TLiQCZwE8I6Uwcco5fB2r2oL
TLSH
T1F4929ECF1F246833E8B54B3DA3D781D84D7AD61DC791EF91509418619ED1880525E06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Chromium\Google Chrome\WebData\Default\Web Data
Size 138KB
SHA256 da654c13f2480663773540aaef36ab0ce96d60029be00c9763cf850d049203d5
MD5 74250ef4d45e2909217c6fa208ddca0d
SHA1 2d0184432480bbdc40b34d8f5b0d66e532dae064
SHA512 64a32dd5de318231aac684661070b8b8ca295edf94455012170b826629331577afcd39f139362e46e1ddba3546f7b9ceee0529ad8b7dbf414e1ad808d6a7e79e
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OyW7SVumdnr:FnbZeMrv/hGtyycnr
TLSH
T1C4D3854B3A743102EDE5DA721CE050BB5D3CB16D8F55A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Gecko\Firefox\Profile_0\cert9.db
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Gecko\Firefox\Profile_0\cookies.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

key4.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\Browsers\Gecko\Firefox\Profile_0\key4.db
Size 288KB
SHA256 c266efacb1d2a7e0ad259a498bde7099515e93738d658363d2810f5e3c7e9cc2
MD5 320bb49eb37aa24c208d2e4f6e00cccc
SHA1 d51c11beafa9ecf53842589d7e1e2526af1ba584
SHA512 c2b3e87007a840aac63ed0e984713b8600cba0b0cde0d7927ba8f7bc2d582f53eecc2f6c5cd31fc5959ab7794963ac7f946921afaa547a29a27803e41df5ba61
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vA9+CgvBa:f1zkVmvQhyn+Zoz67J9Tgpa
TLSH
T11354CD47ED84F10AD71A2830C9415DF27E41A70447815E2BDAFC1E3E1EB560DBAAC5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemInfo.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\SystemInfo.txt
Size 482B
SHA256 16c631cde366f4270360cbfa01cfa8167d85ef89969f1805d39a80d3eec3aa2e
MD5 4e1457d175a2ba5669ebc67a0c08b232
SHA1 be2174c3072162602b38a90ba2994da01f5c80c5
SHA512 4373a58c6c3248dd3f66db04dc3b5489aec457d964b259445e0c514e615a821c857101a04d4219cde860316222f2a0b352ab591a324648baca014d9a9ceddb72
TLSH
T105F0DCA484089024247927F4A2A1DB1137F15A13B1A7C03EFBEEC288ABC3B1853B6538
MD5 SHA1 SHA512 TLSH

Submit Download

V10.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\V10.txt
Size 113B
SHA256 deeeb9c162e3513d5b15a9b153adcb577daba19b01a2a686256522bc564443ba
MD5 2bfc6e48c229cae3de410010ae4943d7
SHA1 8c4b97a7321fa9efe8862be2cb7ef23d541a3f59
SHA512 9e979484f46d71251529842dba705bbb65884e54430ae3950587c2f3f296f883c87985e4a08525d870f118d7db754b91873f1aed6ffa3ccbbe676e0c154d3ab3
TLSH
T1E4B0228C300A3C2E3C0EBC00C800F2AC0BC22E38C2208FF22E03E38CC08A202882C008
MD5 SHA1 SHA512 TLSH

Submit Download

V20.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\V20.txt
Size 113B
SHA256 30138d514f9b7df013c8056b156fb96519b54cf6179aaf469e6d03e3ee0c0174
MD5 1dd4ae5af2bb4645e09cc649ab82414c
SHA1 3d1108f7a4b0a56a3d7daa051dca1c4ffff1de1d
SHA512 4759a6967e193c164d063ac7d3a3bff31f1e4a5536ead2b6afa016172fe69454e1171ce9e0b1dd00fd66b1754269e8e4a6e192946ea3d1d1c668ee0c2e661632
TLSH
T1E4B02413C0C4031D400FF17037D1F1040F414014C7470C530C03D44C0543C40C1D1313
MD5 SHA1 SHA512 TLSH

Submit Download

monitor_0_1787098925656.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\monitor_0_1787098925656.png
Size 602KB
SHA256 67d0fcc60db5d43131a5baf1092a04c160947535ca1cbaa0539839062c16b531
MD5 e208200def30dd9bef2604cc07a0577b
SHA1 7c04dc442c59bde7b8ab5330ae0c6c4f04b1a3db
SHA512 a381e753d93ad83ad11cae7e327abbc8e390588096c837119f6afe12ec429aa30b39b05b5e422afeb19a5ca1ef12526a902f63544d4425a43a5cbe46bd6797ea
SSDEEP 12288:g0/WOlcFZi3qd8HU1OPRiRhGKRTmbdesf8VUpqLU4HlO8l5+F:gHO29GIRhGMmbdelxtWF
TLSH
T168D423B8B5A1708CECDB543BCDC69FCA4B625033CE3C186491A67501564EFA43A7E3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

result.zip

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\2026-08-19 01.22.04\result.zip
Size 628KB
SHA256 11e50ccb5f386bcb822b18fa72d24a7032ccb91858d392775a61ffd2f1357c3b
MD5 ba3b7f8d33c01ed5323637c0cd4cc77c
SHA1 2717bbcf2a31b43c93f331aae8fafabef4e17cf2
SHA512 05551988df1c0c93c17075d5a638cb87636a1cd5a043d0c845fdf4fce7ced957601d82bb1a02584a7d6aba06f30286a945e654fa054c5b944256f3c648aa2c2d
SSDEEP 12288:WbP21W+DFjImmWFd0/c23S2r1iWr2OFFppR2nuimPICstwEPXg2aU0U:WbP2w+Sm/Opi/W68FppR2nuimPIjtFPD
TLSH
T148D423BF990EAD2DC45B80FCB78EF2161C6474096A2D9E736B0718AC6979D8B0D4D843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sheep.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sheep.a3x
Size 1.7MB
SHA256 f73b6f911e19cf74dd9f72ffffceee56e2ff0d00914cc9cdd13eb49eda5992cb
MD5 c0479e3a601781506bb725b2eca88b71
SHA1 102dd5699309a4501bc21d0eab5629599ccdad1d
SHA512 25b92be4b7e191144d7d84870b17ac383c8a41ca37540505180f19086cda38870e05b971db4da51c46eff28519de2396a7b45709d73c9389c7d3c5bee23e8f59
SSDEEP 24576:k5Pm/jfK4+JFD81lXnSVoc7rl69bVi0pmyGyKJDhgIGGWh7jPJV9OOHsoUWqdtF:k8u4+3DanuNroxH2JDh1GGqbOOMFPdtF
TLSH
T1FF85338681CCB02C3B263067CD62718B117409FFA6F9B8D3BE68BF1576BA899C51F541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0jdcsfkm.m1l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jdcsfkm.m1l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-18-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-21-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-154-0x00007FFA46430000-0x00007FFA46542000-memory.dmp

Download

memory/8-50-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-57-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-59-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-58-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-62-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-64-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-70-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-69-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-68-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-73-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-76-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-153-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-80-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-81-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-82-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-85-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-87-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-92-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-97-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-100-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-102-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-10-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-43-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-11-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-13-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-14-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-25-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-28-0x00007FFA46430000-0x00007FFA46542000-memory.dmp

Download

memory/8-48-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-44-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-32-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-30-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-15-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-16-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-17-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-19-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-20-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-42-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-22-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-23-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-24-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-26-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/8-27-0x000001D19FD80000-0x000001D19FE9D000-memory.dmp

Download

memory/692-8-0x0000026FDA110000-0x0000026FDA111000-memory.dmp

Download

memory/692-7-0x00007FFA48EA0000-0x00007FFA490A9000-memory.dmp

Download

memory/780-41-0x000001F162E60000-0x000001F162E65000-memory.dmp

Download

memory/3128-123-0x00000252E69C0000-0x00000252E69D2000-memory.dmp

Download

memory/3128-124-0x00000252E6660000-0x00000252E666A000-memory.dmp

Download

memory/3128-122-0x00000252E6660000-0x00000252E666A000-memory.dmp

Download

memory/3128-121-0x0000025283C30000-0x0000025283CE3000-memory.dmp

Download

memory/3128-120-0x0000025283B50000-0x0000025283B6C000-memory.dmp

Download

memory/3128-107-0x00000252FEBA0000-0x00000252FEBC2000-memory.dmp

Download

memory/3936-75-0x0000016BDCC10000-0x0000016BDCC15000-memory.dmp

Download