pony | 9ee9c06c0ac2d053cbae65167513e1ad241a6d952d7672f923bfd9b221f48538

Analysis

user interaction
yes
max time kernel
141s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Builder.exe
Size 32KB
Sample260830-eewrasyarb
SHA256 9ee9c06c0ac2d053cbae65167513e1ad241a6d952d7672f923bfd9b221f48538
MD5 85df7137538e6c3eb87976fec95d8e16
SHA1 d5191d2d636544b05cd2faa14ef4d60e9c4a861f
SHA512 55eef83e7dfeba4150566c5b410173fdb4b3b96d969f6466fd8dd2f80aec5f22510a1379e19faff4036d9910a6a46036a2c219225d775ab29461ca44d61f514e
SSDEEP 384:aKDr6acgvJk0ZC2VYzqsGgaCCYyUcuVFg/DlEQc/KD:VJvJtC2zC4+Vgli
TLSH
T1DBE2D9338A284871FAD686B205B158F61523BC2254D1AD8B16C85E6C1D37ED3FAF472F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access discovery execution pony rat spyware stealer

Malware Config

Extracted

Family

pony

http://myp0nysite.ru/gate.php

Attributes

payload_url
http://myp0nysite.ru/shit.exe

Signatures

Family: Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Downloads MZ/PE file 2 IoCs

flow	pid	Process
69	2284	chrome.exe
69	2284	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	shit.exe

Executes dropped EXE 2 IoCs

pid	Process
3940	Builder.exe
1228	shit.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	shit.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	shit.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	api.gofile.io
59	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe
3788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Builder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134325355363953217"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	Builder.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	Builder.exe
3940	Builder.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1120	2932	chrome.exe	94
PID 2932 wrote to memory of 2796	2932	chrome.exe	95
PID 2932 wrote to memory of 2284	2932	chrome.exe	96
PID 2932 wrote to memory of 2796	2932	chrome.exe	95
PID 2932 wrote to memory of 1256	2932	chrome.exe	98
PID 2932 wrote to memory of 1256	2932	chrome.exe	98
PID 2932 wrote to memory of 2308	2932	chrome.exe	99
PID 2932 wrote to memory of 2308	2932	chrome.exe	99
PID 2932 wrote to memory of 864	2932	chrome.exe	100
PID 2932 wrote to memory of 864	2932	chrome.exe	100
PID 2932 wrote to memory of 3776	2932	chrome.exe	101
PID 2932 wrote to memory of 3776	2932	chrome.exe	101
PID 2932 wrote to memory of 4436	2932	chrome.exe	102
PID 2932 wrote to memory of 4436	2932	chrome.exe	102
PID 2932 wrote to memory of 1104	2932	chrome.exe	103
PID 2932 wrote to memory of 4568	2932	chrome.exe	107
PID 2932 wrote to memory of 4568	2932	chrome.exe	107
PID 2932 wrote to memory of 892	2932	chrome.exe	108
PID 2932 wrote to memory of 892	2932	chrome.exe	108
PID 2932 wrote to memory of 1516	2932	chrome.exe	109
PID 2932 wrote to memory of 4948	2932	chrome.exe	110
PID 2932 wrote to memory of 3352	2932	chrome.exe	111
PID 2932 wrote to memory of 1656	2932	chrome.exe	112
PID 2932 wrote to memory of 2576	2932	chrome.exe	113
PID 2932 wrote to memory of 3792	2932	chrome.exe	116
PID 2932 wrote to memory of 3792	2932	chrome.exe	116
PID 2932 wrote to memory of 1104	2932	chrome.exe	117
PID 2932 wrote to memory of 980	2932	chrome.exe	118
PID 2932 wrote to memory of 708	2932	chrome.exe	119
PID 2932 wrote to memory of 4276	2932	chrome.exe	120
PID 3940 wrote to memory of 5080	3940	Builder.exe	122
PID 1228 wrote to memory of 3788	1228	shit.exe	125
PID 2932 wrote to memory of 4504	2932	chrome.exe	127

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	shit.exe

C:\Users\Admin\AppData\Local\Temp\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\Builder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0x100,0x124,0x7ff9101dc728,0x7ff9101dc734,0x7ff9101dc740
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11722612671123926707,5396245409721775071,262144 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,17021837795104148642,9336843640320978736,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7155572458220847401,7909613853484169244,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,16348413578528595067,11157637799651621565,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,3204591043214916057,9152420384833509693,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,15456077229216383447,11376773182112268871,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,11280320619532654290,14113582930294262310,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,7407129049089651324,8204293245793142363,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5884,i,13075680598567796291,16486858043813183795,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5980,i,395604883985899047,12743932888343601943,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3340,i,15916480069870818640,12616494776072311417,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,6046604220880294306,7038571964640385164,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,7106900651862562900,699536183526255190,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,16608507200748744866,10172744332736284245,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,16002815142318666726,15540651082071265469,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4884,i,9095500464166200340,16349309294294214192,2097152 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,11572120078440210750,14985507716159393605,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,3673559164968257509,9095540007484656808,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,12343549548884265240,2168735070051433232,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,1144770873217609252,17497062468992739268,524288 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5760,i,16572184819728062128,8850861283830531159,262144 --field-trial-handle=1948,i,1679289134527678224,4409398857286361545,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:964

C:\Users\Admin\Downloads\Builder.exe
"C:\Users\Admin\Downloads\Builder.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ""C:\Users\Admin\Downloads\packer.exe" -9 -q "C:\Users\Admin\Downloads\shit.exe""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5080

C:\Users\Admin\Downloads\shit.exe
"C:\Users\Admin\Downloads\shit.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240771671.bat" "C:\Users\Admin\Downloads\shit.exe" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 293d0cb594d875325fd5a5cd96f0ae899bc4354ad7b895a6ba1a01bad1fba088
MD5 ecfd2200d087a959a90ffdef47b8eec8
SHA1 dae10ac15d5f4365156f901e1bd7dca0d433f9a0
SHA512 f7e8304a85a4a7cecf96de491abea380ebe38e4f1cb6b3b237f97379106f83c62e4df20e8e2589e3b91f4f01459e441096980db47e38c308b8a087482f6b80f9
TLSH
T120E02BABC831EC3B1CFE4B1850994B45EB5913562AD0492F3A3CC20C4FF162A418AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 32KB
SHA256 9ee9c06c0ac2d053cbae65167513e1ad241a6d952d7672f923bfd9b221f48538
MD5 85df7137538e6c3eb87976fec95d8e16
SHA1 d5191d2d636544b05cd2faa14ef4d60e9c4a861f
SHA512 55eef83e7dfeba4150566c5b410173fdb4b3b96d969f6466fd8dd2f80aec5f22510a1379e19faff4036d9910a6a46036a2c219225d775ab29461ca44d61f514e
SSDEEP 384:aKDr6acgvJk0ZC2VYzqsGgaCCYyUcuVFg/DlEQc/KD:VJvJtC2zC4+Vgli
TLSH
T1DBE2D9338A284871FAD686B205B158F61523BC2254D1AD8B16C85E6C1D37ED3FAF472F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 336e65f3b79ea20a96838c677630bee9bdd083e710f9fc4b3a0683211d06b666
MD5 d2c5a4c5799c789326a3767137ae92b5
SHA1 f0c1478cfbf3b56b812d0b878c5fde88ad3251d8
SHA512 12792d6e036076dfa9a3a6c34abd587421d6d41eb223a28a688b8bf718af70cf75ae39ca1b2f7060a05c0180f227506c8e3d6d0be2a8fc17ca940d5804120c87
TLSH
T12F2185F4713D0031DB125EB0B4C480627C32F7800B4B7E9EB03705780603BC785555E0
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f749d2445cbacc9ae584fb4f65c14c34c13f7394fd3696033605f9219f3ba4b2
MD5 6ecc27a914e67011f7de76ff2081a671
SHA1 8ff04e5db3a8fdea688e26047370b8366cd191c7
SHA512 dcf35e709747b24c763a228c99730d9018fdf3c0088bf5195af745baac68f5b583ce0264446c6573b964642ae43600aae0fa6fad9aa2db588302a27e09b5d1d1
TLSH
T14A518BF7D3E88A6D891196F4EB116E2FCE6D0914432C3D66C9D4AE1B53E3972D20038E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c4dc091c470ba03fc5d857eca201f9c71a392d750fadbb602227a570254285a5
MD5 6dd3010b9e76eaa4cd6b3cc554313438
SHA1 7fc02cb8d8256b572a54e807bda7c1e920ba61f0
SHA512 f8c821eefcd739fed31a0601a8bcc6847729914eafa681fa36b91c27b25fc78149ca07cd1e0199a9089445c9958908409c8c007fe705c6eef881efd6a9a0a722
SSDEEP 192:rRQQL/aCLwLvJ9Gv7hpAPRp2W95Hsb+WNnMj0fIKkwd6XOKVyIsnAUgtaJ:rRQui+ADy9UXtrwU0gKFK8
TLSH
T1B642FA2EBD10647B8CDBC629FE127757E7F6146121942E84EAFC892C15EB5CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e2023ce6ff47bcb309a56b95d5e8b571cfe179ba02c7506ed555f8cf189740c1
MD5 1e176cb4a2d828aaacfeb51cc407f7b5
SHA1 686abb117b121c7d77070006680b58ce0746f8dc
SHA512 c24fdf366915262e3fac95282fe45f09ff3fcc1bfe3d39c230352bf17fc55ec005a01f82a1ce18bb3de9f5b1a3cfbbbedef4757b75c8b04f0078b0b7a8722da1
SSDEEP 192:rRQgLBaCLwLvJE0sv7hpFPRpVolS95Hsb+WNPZW1Mj3A3eWIKkwd6XxKVyIsnAUp:rRQ+Q+A2049jXtrwo6IePKYKe
TLSH
T19452082FB910697B8CDBC629FA127B57E7F6106221942F84EAFC892C15EB5CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2a37ffa5ad8b3ce2391310e0d41e02a5a860afd1b63fca5ea98442dec33a5f68
MD5 0fde616cc087c220e9905fa972438465
SHA1 9978c0f0c8d67855b0d75b38c481aad51e1ed0a5
SHA512 979dfcef0a669b1a23340efdee93cf10ed375e4f4c2710cf9da821af6129d1aff88fd8b2d8ea4bd576ae0d014d72fd06b6cb1ac538629fd6c0cfb309864619c9
SSDEEP 192:rRQQL/aCLwLvJE02v7hpAPRp2olS95Hsb+WNnMj3of2zIKkwd6XOKVyIsnAUgtaJ:rRQui+A20C9UXYrwUc2MKFK8
TLSH
T1D442E72EBD10687B8CDBC629FA127757E7F6146121942F84EAFC892C05EB5CD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 300fc5197f18c66007fb95a35d58a5f24978232d6cfe81a273fe7fdbecdda71d
MD5 1c0e86ffd29eab2e1f6f76abda309205
SHA1 e04088b98f21114c47dc260b6abacd9d3a057fda
SHA512 01efad387befa5ebeebbedffee2f66db4c020fe616d354e3f92cdabc02706cb0c131883aaa8628e288c72c7f1cbe09974ff42d4cf815e638dec1ddc705282d64
SSDEEP 192:rRQgL/aCLwLvJE0sv7hpAPRp2olS95Hsb+WNnMj3of2tIKkwd6XTKVyIsnAUgraJ:rRQ+i+A2049UXYrwUc2eK0Ke
TLSH
T12952F82EBD10697B8CDBD629FA123757E7F6106221942F84EAFC892C15EB5CC321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d720843e09d2f62012ae1c315864fcc6eeabd4bd7efcc12e64464bbe8b550543
MD5 475290b443a59458b675fcf34baa9624
SHA1 f978dcb7689bd7d352a1e0eb389e70f8225fdff8
SHA512 01af362d750a54fbeddfdd3fd686758614b5cd30043ca6253065563a5f68ecbfb79e2633ce16ae2851fab3387d7c57f2215dd1a6236c17decfffc130a7a5db45
TLSH
T180B012C180025202C40303F8255218DCB314DF10960A1B0263F0AA27CC25350C11A060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d934.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d934.TMP
Size 96B
SHA256 51da98fe8f26b6bc2c9a37bcf225ccf82f6ce141865890164eb30426f27070d7
MD5 25a0102eb7251519dfa8266e425d36a6
SHA1 f3c6d639a508b60af92e62e7e860f40c4cc3ee84
SHA512 7dbc7ab769c9e510eff9090fa3249c2353d3e057d2ae8f7b069cf69b17f9ebb6a0c1be0bcbbba21107b70baf0795e1ebdf86aec6d4e7acb85758a02f5c75bcba
TLSH
T1F2B02280C0023202C0038BB038BBA8C8B230CF20C3032303A3F02B2ACC20B200030CE0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 648e4456cbf6c4d944f7bccf1f95ceb3059fb7ae143c3cb65916e2f5772f80bf
MD5 70536c18eaba32536ebc18dd4cc3701a
SHA1 b427ac42f96c9e8d79519326f9f450a67e5a5eb4
SHA512 066a13fecd3fa46f46cdee151af71151c7266e8a4280e3c9f580651d7aa9e7c86ef6ff074db9546e2a3c92542438fe93272636220127290881130eb3378c0d03
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OCpX67gqwRVumkwk4OQ1:jeuvBnhJsueMEGvIW1DcP2OKRRVumknW
TLSH
T18FD3A74B3A747102EDE59A725CE050BB5E3CB16D4F55A1D428B620688EF2823B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 0cb83f841d7e7624b8971f5f82b27a98d3061bc67200a317e3ddbde3ba931155
MD5 88ef7eb4205bf1ae012b98064f97ecb9
SHA1 1f13240af6f1cdfe1290c26e666f28864d3c72c2
SHA512 b3d1f76ca2b037209730286deb200b7a44972ba0aaf35b7b31c56cf54168bb93b82b1a565f69b2fff9c6f29f0f6e72206eb31542624521731547de6ba0538d71
SSDEEP 3072:n1fiv5sLxaHo2iRmHUDstdcaRiv1F33pCqfd7NtZL8cHQRZEQ6SpsS:n1fuSNaHjImHUYpRs333pCqZ/ZLW3ExS
TLSH
T1943423371F895D378F97DB44961A1BD75FB048791074E208DA3D3BAB248BAA0D202DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 80e1767f08290f52a9b32b0839d90572d9a0e9402aaf756dd17d2543a0bd38ba
MD5 e0980eba336c91ad9f1d457701cd8636
SHA1 fe2d146febaa7522e88b043edb0a173e7da7008d
SHA512 915ceeb3ded873f11dc127dae02dd60d747f74bbe1efd5b6658ddcbb2b13caebedfa92a63581ff1272fa24f5038301da499cb959af1f9cd6238c6a40c12b65a2
SSDEEP 1536:6oyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:rqfd7NtZL8cHQRZEQ6Sps9
TLSH
T111C30237EBC21E339D82CF64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 d8ee530a207b1da7bf5b1f11f67b434233e90667dac0a8b7c319c51c3cc480fc
MD5 5bb7e873324c0a78fd94e32380046529
SHA1 780cb7143af295549af7959d0585c574800502d5
SHA512 5c8e6d27b66fee266321ecae4bd894b3e380e7f90e7d5c0022e6e82ee71c0de7b7af1adf2f800c136866a8111aa4f49ed34374629f46f059bdc4afcd309fc2bc
SSDEEP 3072:X7fiv5sLxaHo2iRmHUDstdcaRiv1F33pCqfd7NtZL8cHQRZEQ6SpsS:LfuSNaHjImHUYpRs333pCqZ/ZLW3ExS
TLSH
T1AF3423671F895E37CF87CB14962A1BD75F7008741079E204DB7E3BAB6487AA0D242DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ee6a5c41a61c496e3087214a818f393e9cabb5f2d22fff27d98d2bc35f7a7911
MD5 58f192516b6006c489cc4d247c1393fa
SHA1 b950cd08c5bec59c416ccc269dd5c7eb601d2e88
SHA512 d8f6d81cdd84ca32dd1b81d9e2f9c2ec8f16917fc80ddd54b18b43be3e6214aa9c5717e4bd2ede9cd9dc20f73d49c4a44af0924b77d710951325ea9f7a5545d2
SSDEEP 3072:s7fiv5sLxaHo2iRmHUDstdcaRiv1F33pCqfd7NtZL8cHQRZEQ6SpsS:ofuSNaHjImHUYpRs333pCqZ/ZLW3ExS
TLSH
T1EE3423271F895E37CF87CB14962A1BD75F7008741079E204DB7E3BAB6487AA0D242DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 48f3e84d9afe26adfd8b33e12e8c41ea6dddb5c80966204b3f59ab75b1c602e2
MD5 49d429b01be78754512c0ac847c2122a
SHA1 189be69e408545d04b8e193b57b3a528fd5e6127
SHA512 0e0a757f0025e144b779a44fd1f309752eb258fda8c60e111ed16f41300cba02691901ab7458221b501754577f22e42a96d37697fabf58e639974d88aa705354
SSDEEP 3072:r7fiv5sLxaHo2iRmHUDstdcaRiv1F33pCqfd7NtZL8cHQRZEQ6SpsS:XfuSNaHjImHUYpRs333pCqZ/ZLW3ExS
TLSH
T1A03423271F895E37CF87DB14962A1BD75F7008741079E204DB7E3BAB6487AA0D242DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240771671.bat

Path C:\Users\Admin\AppData\Local\Temp\240771671.bat
Size 94B
SHA256 936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
MD5 3880eeb1c736d853eb13b44898b718ab
SHA1 4eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA512 3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
TLSH
T1C4B012EE27474021B358A90498310D56833800A38478145831CC26C463E78288C9208C
MD5 SHA1 SHA512 TLSH

Submit Download

3e7e0a1e-b781-4f5b-ba35-9c6fa884ced3.tmp

Path C:\Users\Admin\Downloads\3e7e0a1e-b781-4f5b-ba35-9c6fa884ced3.tmp
Size 178B
SHA256 e2912925088cba3387a6c35db876a6efa08c365f140d448131088ea314709a59
MD5 0a706ef1a837756ad64088052417be4d
SHA1 af492475e26d7723d7f816dbd036f63e419e21f0
SHA512 3de8d8c541ffcf44c93ddc625af566cc3f8155ac7e5311248e68c50f6754a945d098370cdaff748477db9f3cdd05ecfe33944857ef8a0ae54f01a6a89d2b252b
TLSH
T110C012A1A2800B50D5C48B3108C7BFC1AF76C133E1972322F92ED0210B14E203D7C34A
MD5 SHA1 SHA512 TLSH

Submit Download

packer.exe

Path C:\Users\Admin\Downloads\packer.exe
Size 384KB
SHA256 af2a69732883c4cf3205a2e56d9f576b53785b539929c162c72d9e4e8679aa59
MD5 4292c15c5bbe3cdad29ba03c0c89a737
SHA1 65a6a7ab28b926e84eb6e4b7467e0af089844be8
SHA512 917471c4464fda033492550118f8564c1d1d6deb4d66182b57982fea0e03229c65b15910ae1e9e925699a89ca4eaf886eeb9726347d70a478cc71f47bbe6b502
SSDEEP 6144:ToS1VH0mKULjziPdf4HG8OVFbkcR2+85evDU5byEB5SuGI/dTZnEOseUrLh9rhrs:ToS1VH00fm5yOjpg+gekbZ3SWHPavo
TLSH
T1C78423335C08635AC11D02F99B65FF7EF496E48A51B3D5AA87DCDBFEDA9430422002B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shit.exe

Path C:\Users\Admin\Downloads\shit.exe
Size 90KB
SHA256 6a8b69d127fc77536bf5e2e385d1202bf64c66b34c83dc49b9282e01df35926b
MD5 425e018660303c9d12cf725990034505
SHA1 8b151639a65c610bbe3e81106ae582c9b90d1a47
SHA512 4f9a53c71f6284da19d21430ed2dc69a9225ac8dac7c4f520767734a14a918a5cfa1967953a273d284a8337b8e5ec5fb27b33d1feddf583ce29520b04ea0a217
SSDEEP 1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIWkzmt2l:2SnMuGc/CfZDap6COU45EIGtm
TLSH
T172930803FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub.crdownload

Path C:\Users\Admin\Downloads\stub.crdownload
Size 90KB
SHA256 7efdf3b1f7013680f3eff1aad5a2c5931c9efa41f6f2289d42c5046a6fa85000
MD5 7ffd2758239e0991f9e9ccea49fc0341
SHA1 a11ae66f9144870ad37b4700ea41b3fd05ed8282
SHA512 bbea45feb4c2ab32ae5c2aa81a2c3ce96baf412006d5cfe42cffe689f8c394c579cf13478e6293429177565a3ee07beb00fd0f660bf570259bb91b36ab3c20b2
SSDEEP 1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIbkzmt2l:2SnMuGc/CfZDap6COU45EIjtm
TLSH
T125930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download