a555f3638c53592b3789df8a4cd03a225a2fb707cdde646887678dcbbbfa723f

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.4MB
Sample261002-k6ak2ascjf
SHA256 a555f3638c53592b3789df8a4cd03a225a2fb707cdde646887678dcbbbfa723f
MD5 3f84cf4998a9423a4124dc0483d90441
SHA1 8a52d1b50cf59e9dbee80fc1f785387dbeccfefa
SHA512 b9cf57ce5622be35234a97c39d8a200aeb553426b920745cf273fb321994ee9ae573326360b48d5971d8a8647252848ebb8027f3faaed86fedc8c070202dacbc
SSDEEP 24576:XUCtrDLWk0yNVBSP9HYoHmAcuEjR0bmhmwiYDcZZYzLoybWr0S/n2ER:kYSnyNVBSP7HUPOahBiDaEybWrvp
TLSH
T14765234207E50868E5A52375C8E3D6935335FC454B38AACF22A8FFDC3B229968475F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4684	AutoIt3.exe
3528	AutoIt3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe
3528	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4684	AutoIt3.exe
4684	AutoIt3.exe
4684	AutoIt3.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3800	2936	file.exe	86
PID 2936 wrote to memory of 4684	2936	file.exe	88
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 4684 wrote to memory of 3528	4684	AutoIt3.exe	105
PID 3528 wrote to memory of 2072	3528	AutoIt3.exe	106
PID 3528 wrote to memory of 2072	3528	AutoIt3.exe	106
PID 3528 wrote to memory of 4856	3528	AutoIt3.exe	108
PID 3528 wrote to memory of 4856	3528	AutoIt3.exe	108

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SYSTEM32\at.exe
  at.exe /3ZTtoBY3RmyGDox
  2⤵
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Evil.a3x
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

content.ts-B6XGI__y.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\assets\content.ts-B6XGI__y.js
Size 7KB
SHA256 cb83dde76246776a90fdcd31cd45e97472c0d0af80995c24cbd2ac24a890e7ab
MD5 6b1f2c5e7d10872d71a0402318958b68
SHA1 cc8a541c5cab922ab5c37fd180e6f38fd45925a0
SHA512 ee4b075d2d1cf54c4cc468e8e27d55858a2b56a02fa059e325f4a519e3894a70d2b6a497de85dd0e2c137ee147b4c2b87238ab15b74eb8bc511d18de05a37171
SSDEEP 192:fNvK4Y9/bQmFrlO33opWLCSRIKFVpvHGOchwepso0nwpnmdx6VxxwafWhdZ:f1KFQmWL/RIKF7vHQso0nwBmdx6VxxdM
TLSH
T131F1FC453F806432A7568DA3AB27B0D0F9523C1ABDCC9DEBC514BD692C43527C7D2A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csp-strip.ts-DrI45pKU.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\assets\csp-strip.ts-DrI45pKU.js
Size 4KB
SHA256 cbc00e40d8a69b6812e80242caa6dff8283dc0a3366b1d9b18b124547c6f6b69
MD5 8a8729bcf69479eda05e0374286588de
SHA1 bb0f496629d7dbc24ada8293d1e15462ef38fc0d
SHA512 aba70929496d0f2b3f8b3351efae9508d8fd905ae308348b2c5696825a5b872dd596095f2a1e3451f6a387d2048ad6befaf508474e0bda3d124617c5520fa0ab
SSDEEP 96:gAl+rekL4DWXAGcyTT8J6M8WmepFvJ930hmTw+IV:gP5+WJTa8WmWEoxIV
TLSH
T1F49142503E81A6D6330A8BDBBB2F14D5E52FA85F38460D8B60086D493E16531C7C7B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\icon.png
Size 158B
SHA256 bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351
MD5 ddf750fd2569862fbc571cf73afd1687
SHA1 b136b37bb4b70599e141f8561ff303b592f95743
SHA512 bde06725d50c11681f638410f1c5285a23fe2d7ea74e54b25a2ce4957d2c1745cbc3504ed53eb8004d31a1b9a1225745c50fbe4c29273a9fa98214ecb598f51e
TLSH
T152C08CFFD7904C33E4680421017C68238526197C5A89E112D09248A43932448CAE9AAB
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\icons\128.png
Size 6KB
SHA256 14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43
MD5 12418c9ab11ed9ee088f4a9dbdb578c3
SHA1 66d335dd5b36b185639e6c7d403466a94b15001f
SHA512 0f7fc0dc9c9724e39f6203affe70a487bf85b0f0fdd468cf236cc3ff659692190bf43ed60cd2c89b6f616ab6090a4840a6eab4e5611a7c3adaeee0c687f6ac24
SSDEEP 192:sP9N6BlbaMuTz2ezeDLO9PDhq8TdZrkrZpmRvJPCXYwm9EbAhb4:ECbaMu+bOZDhEsvcm9EkR4
TLSH
T153E18D2ACC423BB87B5E5A5560D9370D8C62A70EA126EF235DBB3E907CB2A2155B8050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\icons\16.png
Size 654B
SHA256 e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb
MD5 4222c9bc3edff30070ad302f873ab597
SHA1 2858ba5545e43723dbb2bccf371f72445fc6abf3
SHA512 d7ad3a1565aaf31cddde96b9c3bb09318f6872abc8dfb081d6ebbd6aae8579a7d57e07cf2f017cb3bafa9d168ee4773bb1b5398f36b977d568693dcc55f2883a
TLSH
T177F0835277B6007E0B08A030B44F9DA928E030B9A081A17B54230930BD5C4C804E8EB1
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\icons\32.png
Size 1KB
SHA256 1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681
MD5 6eca9ecd18a38c2669b341cf982d79c9
SHA1 f74defb097d39eab2548ade8cbb53ddadb2ebb7f
SHA512 32e97da9ecb6907cf97b3d05467b91766c5fc1c14e0283a2ea8c24ac72f2a000dd99a1ff468de73903f70f0d0d1d2580dd7786948d389b8541f9f75537a8890c
TLSH
T1F621D8125263FDF7F797A13EC1394C51845F0CEAEE183A4AE56633D82B71B5288C1A87
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\icons\48.png
Size 2KB
SHA256 1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b
MD5 81d4dab3bd89f34b04f79dc7f3c4096c
SHA1 c1d8ba78f7318a94253ced3a0769256fabc86ec7
SHA512 b24e75cb11129361fd12afbb6d89bccd619f36fd71cfa4d5b437c5b98f91994e1a7d44f4b4dd16617692b8383e0034aa16e5736f1b935a90986798eb27ff5107
TLSH
T17A410B2D89B51B91DA5901FAEF1520B1A8B9DF38113442BFA111EC68194EDFC3182203
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\manifest.json
Size 2KB
SHA256 d82d6d1c1097ea403fbfd0976682bcaa5b401fc7c33a834bdb2a1a882637bad7
MD5 805fa4883d3af385097038c5ba827872
SHA1 5755ca1166691be38ae30503e475452f675fd225
SHA512 ec1a9c5304718fa4c70e55158a63078f0ec5245b1dae1b34a59e49602223ff5c30cdb8817ac92d646890d5b3d848de063101da1ecd8909eca142a5b241970120
TLSH
T1BB41AA25D9684C7B03DCA734ADBA5A8399150A878CA47C1C77DD800C8F7D61F42BABAD
MD5 SHA1 SHA512 TLSH

Submit Download

strip_csp.json

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\rules\strip_csp.json
Size 750B
SHA256 530ac7abda5efeaa370b60521bd615b0695a6c968f240bd21bd7f9e997852baa
MD5 197a5c91db8dfd3aea9295c61b155dc8
SHA1 777f0cefca0a109c21ecaee04a53b26792ebae0f
SHA512 da59e796602b90c6d484ca3bb2059493015e077e1b086faf3fe3401ffda14085a99e469c6fe198479acb170b4bf156a86b3ed3dc4748e52103f192db8b589fbf
TLSH
T15301D6B7CC96EC2702F1A325E1659619F170530F9750011F3A7C459D9FF9360578AB4D
MD5 SHA1 SHA512 TLSH

Submit Download

service-worker-loader.js

Path C:\Users\Admin\AppData\Local\Packages\Extensions\98D079769C17D6E26E07C6C4766F0DA33C2313212A1C81CABA5C93D954A51538\e0\service-worker-loader.js
Size 2KB
SHA256 4dce82e736cd50fbdb4756a540f788abfd154d015d7ef108c788e6d20f72c9cb
MD5 dfb2131b83ff422d2062fc42452f3ab6
SHA1 00b4753eeda5980961c884d478b17803ec8b5627
SHA512 534559abca1183920cae995eaa134d62bcbc3710175cecade08144924e40ce4128fe2a6e4ca4d9bfb4130f6d06dae9a26d5f96f620f8302c7998c60e7ea331e6
TLSH
T1D04111456F901D8513AA63B31A2FB2E1D96CDC8E3FE60C0FC0A1B5D66E545A0C987E30
MD5 SHA1 SHA512 TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Evil.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Evil.a3x
Size 762KB
SHA256 fe7a11d45c6410c0f62c7ed780877f8e5a1123dcf9253e8983fe6e324b75845e
MD5 9f42cbf496f458f72a289b2e2b4004d6
SHA1 ef9d927f77c656162057d33bf368735e1ca487a8
SHA512 1a5a81fcdbb36a2d29ce9ecbb9df8853aecb35907cb994b3a451562af61a00baa17d34ab29094602ca70c4bc3218ab7c8edf9688f245d024e9cd86a56443ca14
SSDEEP 12288:Ji59I5k/OsAGNvBSPhHY30rixArmTAdT6exX2jR0xBMZIi+wneTXkHOcZZkthSU:wLukWyNvBSPhHYVGmTAuJjR0nmp+w6X9
TLSH
T142F423DB0D6734645ACB21FB9C13EF47D64FC339BB289EA495BDA16CC63862240B8075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ck_3528_240714578.bin

Path C:\Users\Admin\AppData\Local\Temp\ck_3528_240714578.bin
Size 32B
SHA256 03afa79418960905a27f63fbe1f86d70e8ea6fe88598b5eb20b47a1825b78097
MD5 d4de5e7e8f1e7b0406c2f3768089cebf
SHA1 b7d107689aa336747ac0081054b794f933c5c8c6
SHA512 b52cda21c396451eed17ea552ed3056723d76935828a17c3f79ecb6226d10f92e23918da9ce6a10c3ca5b2ba56f1bd804058156681aa04f081e03ee6a879eb9b
MD5 SHA1 SHA512

Submit Download

extF98E.tmp.zip

Path C:\Users\Admin\AppData\Local\Temp\extF98E.tmp.zip
Size 39KB
SHA256 1d56d3e8266e38405b9d2a49e74ed0e8b93e5e6d788b52b0a7dbbedb72c4ea08
MD5 0e68e0ae4bfc316c33648fe222fd38eb
SHA1 420ba1df2d2ddbecefdd245890540e3c2923e107
SHA512 4852d4e65d009ccd77cc6be2b0f872b0cf98095fbfb44b196719c51c89697bdd3171a74db9b81ff19d102a9f79b215ee10783ec58dbe163b4423a09be44676f9
SSDEEP 768:0s5sSLU44gNZWFhetZFH72WB0VpmPvOz7P+b5CfRE++uRSnnpWtb:v5sR4LNZWFhetP2Kb2z7egp5+DnpWp
TLSH
T11503F1255D803EF9CF7F81741C29764528DDAA7EE012E29F88671CF86CA5EF002B85E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3528-24-0x0000017C59A40000-0x0000017C59A8F000-memory.dmp

Download

memory/3528-10-0x0000017C59A40000-0x0000017C59A8F000-memory.dmp

Download

memory/4684-8-0x0000017F7E150000-0x0000017F7E151000-memory.dmp

Download

memory/4684-7-0x00007FFC5C1B0000-0x00007FFC5C3A5000-memory.dmp

Download