Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 02:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
- Size 103.5MB
- Sample260517-clltkaft5q
- SHA256 7429f69e65344569ba74cc2a31369ecca9d6d32966c8750c649b58649659eb18
- MD5 8ecd1d18faa9ca6b48a01a9ce4629f57
- SHA1 2295565f0e9ce5b1c697ab62733ff6a6d3567006
- SHA512 44e17de3edbd98f0a9eb31680e5a089c7a0f1c20b1298d59123cf88c732a48a15678add77ee99c28ad0f70ee5fa5922e8eb5c394276787f32d6f214e44bea221
- SSDEEP 786432:5gsHdMiOAx9EeCUV5OtsFRta9dMf9JrGIeie9b2ihM:LHdMiRx+TU3SKeIeiwSihM
- TLSH T1F5389D15B3E80B06D67FC27CC6639212E7B2B4431361C6CF0598DA993F53BD1AA36276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 4444 powershell.exe 3764 powershell.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852\Blob = 0f0000000100000020000000d98e1bb872efc76d0cbf104dd726115afa0af7a9c392c02d1d6fc83f65347e54030000000100000014000000fd79f49be8a9ccdc18ae6006bacbdb076f3138520b000000010000002800000053006b0069006c006c0045007600610064006500200043006f0072006500200041005000490000000200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00370038003200370033004500430031002d0046003700390045002d0034003800380036002d0038003200360036002d003100370032003700320036003500320030004200450034007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f0076006900640065007200000020000000010000007b030000308203773082025fa003020102020900a6a9a55d32e03031300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323634345a170d3331303532303132323634355a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100c9d69309b57de2783400b30200a6cf756f2af6f1d8168bbe49786e66ade33f560c47eef7846e183c0adf54b4c413242eb4ee0e40233cfb05ecf9e7c3e60bd123c7023fd93692bcfbe775ca3fc73e2ac19c1647e2f65536a5d32ecf2191adf4ae8782af7817bc59328d4391290ed22b3a6f0486c0c2207ca2155c8d0d1fbcfd6e424c88f01a30fee8f72fae259f362bd8fef150ccde2135a82fa99da0ba8c6cb256f06b3250583a9cceeb327c111c89089cf1c54da8631a5cdc8afe1476e11f14d7cfb97b746f70ec7a490cb458c3f57fa3f1a511ce56be0c165a32b50fdda4a6444131ca3110a58513c7b9d2d9a816bc515e59a438feded78b86c5f9d771c1250203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100c60c67469378228a5a3941acb953949e75ac7c39ffdb4b8bcace1e813f8a909eabb0789f8a8bf35329038033cdb94db6d1e4043d2a678206f37425ef63f88d5b17834526ce3d38aed234b657de677a944849f5efc89e9fb37513f3de68678d69cf4b51e47e30410406460961934be5d4e59519d14a32e042089816be74e8a4532139b80df2013ee58aba918461c13770c888e09249b81a8f58d13a5366d66d1b80e86861ed949016c52ec614d1b694512a12304cbf2cb189f5f0fc705ba4ef937f1e7b710d4f0728a2916616505b3b603631fa80f47c364825dbf5f2f68cbff86cc1819254dc0bb642469099dfba0a0dce26ba82a569500ecc750a290c01cea7 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852\Blob = 0200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00370038003200370033004500430031002d0046003700390045002d0034003800380036002d0038003200360036002d003100370032003700320036003500320030004200450034007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000b000000010000002800000053006b0069006c006c0045007600610064006500200043006f007200650020004100500049000000030000000100000014000000fd79f49be8a9ccdc18ae6006bacbdb076f31385220000000010000007b030000308203773082025fa003020102020900a6a9a55d32e03031300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323634345a170d3331303532303132323634355a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100c9d69309b57de2783400b30200a6cf756f2af6f1d8168bbe49786e66ade33f560c47eef7846e183c0adf54b4c413242eb4ee0e40233cfb05ecf9e7c3e60bd123c7023fd93692bcfbe775ca3fc73e2ac19c1647e2f65536a5d32ecf2191adf4ae8782af7817bc59328d4391290ed22b3a6f0486c0c2207ca2155c8d0d1fbcfd6e424c88f01a30fee8f72fae259f362bd8fef150ccde2135a82fa99da0ba8c6cb256f06b3250583a9cceeb327c111c89089cf1c54da8631a5cdc8afe1476e11f14d7cfb97b746f70ec7a490cb458c3f57fa3f1a511ce56be0c165a32b50fdda4a6444131ca3110a58513c7b9d2d9a816bc515e59a438feded78b86c5f9d771c1250203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100c60c67469378228a5a3941acb953949e75ac7c39ffdb4b8bcace1e813f8a909eabb0789f8a8bf35329038033cdb94db6d1e4043d2a678206f37425ef63f88d5b17834526ce3d38aed234b657de677a944849f5efc89e9fb37513f3de68678d69cf4b51e47e30410406460961934be5d4e59519d14a32e042089816be74e8a4532139b80df2013ee58aba918461c13770c888e09249b81a8f58d13a5366d66d1b80e86861ed949016c52ec614d1b694512a12304cbf2cb189f5f0fc705ba4ef937f1e7b710d4f0728a2916616505b3b603631fa80f47c364825dbf5f2f68cbff86cc1819254dc0bb642469099dfba0a0dce26ba82a569500ecc750a290c01cea7 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe - Modifies system certificate store 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852\Blob = 030000000100000014000000fd79f49be8a9ccdc18ae6006bacbdb076f3138520200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00370038003200370033004500430031002d0046003700390045002d0034003800380036002d0038003200360036002d003100370032003700320036003500320030004200450034007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000b000000010000002800000053006b0069006c006c0045007600610064006500200043006f00720065002000410050004900000020000000010000007b030000308203773082025fa003020102020900a6a9a55d32e03031300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323634345a170d3331303532303132323634355a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100c9d69309b57de2783400b30200a6cf756f2af6f1d8168bbe49786e66ade33f560c47eef7846e183c0adf54b4c413242eb4ee0e40233cfb05ecf9e7c3e60bd123c7023fd93692bcfbe775ca3fc73e2ac19c1647e2f65536a5d32ecf2191adf4ae8782af7817bc59328d4391290ed22b3a6f0486c0c2207ca2155c8d0d1fbcfd6e424c88f01a30fee8f72fae259f362bd8fef150ccde2135a82fa99da0ba8c6cb256f06b3250583a9cceeb327c111c89089cf1c54da8631a5cdc8afe1476e11f14d7cfb97b746f70ec7a490cb458c3f57fa3f1a511ce56be0c165a32b50fdda4a6444131ca3110a58513c7b9d2d9a816bc515e59a438feded78b86c5f9d771c1250203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100c60c67469378228a5a3941acb953949e75ac7c39ffdb4b8bcace1e813f8a909eabb0789f8a8bf35329038033cdb94db6d1e4043d2a678206f37425ef63f88d5b17834526ce3d38aed234b657de677a944849f5efc89e9fb37513f3de68678d69cf4b51e47e30410406460961934be5d4e59519d14a32e042089816be74e8a4532139b80df2013ee58aba918461c13770c888e09249b81a8f58d13a5366d66d1b80e86861ed949016c52ec614d1b694512a12304cbf2cb189f5f0fc705ba4ef937f1e7b710d4f0728a2916616505b3b603631fa80f47c364825dbf5f2f68cbff86cc1819254dc0bb642469099dfba0a0dce26ba82a569500ecc750a290c01cea7 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852\Blob = 14000000010000001400000014161423bf063da707f158d4a7f9a1bcd6d11fd40b000000010000002800000053006b0069006c006c0045007600610064006500200043006f0072006500200041005000490000000200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00370038003200370033004500430031002d0046003700390045002d0034003800380036002d0038003200360036002d003100370032003700320036003500320030004200450034007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f00760069006400650072000000030000000100000014000000fd79f49be8a9ccdc18ae6006bacbdb076f31385220000000010000007b030000308203773082025fa003020102020900a6a9a55d32e03031300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323634345a170d3331303532303132323634355a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100c9d69309b57de2783400b30200a6cf756f2af6f1d8168bbe49786e66ade33f560c47eef7846e183c0adf54b4c413242eb4ee0e40233cfb05ecf9e7c3e60bd123c7023fd93692bcfbe775ca3fc73e2ac19c1647e2f65536a5d32ecf2191adf4ae8782af7817bc59328d4391290ed22b3a6f0486c0c2207ca2155c8d0d1fbcfd6e424c88f01a30fee8f72fae259f362bd8fef150ccde2135a82fa99da0ba8c6cb256f06b3250583a9cceeb327c111c89089cf1c54da8631a5cdc8afe1476e11f14d7cfb97b746f70ec7a490cb458c3f57fa3f1a511ce56be0c165a32b50fdda4a6444131ca3110a58513c7b9d2d9a816bc515e59a438feded78b86c5f9d771c1250203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100c60c67469378228a5a3941acb953949e75ac7c39ffdb4b8bcace1e813f8a909eabb0789f8a8bf35329038033cdb94db6d1e4043d2a678206f37425ef63f88d5b17834526ce3d38aed234b657de677a944849f5efc89e9fb37513f3de68678d69cf4b51e47e30410406460961934be5d4e59519d14a32e042089816be74e8a4532139b80df2013ee58aba918461c13770c888e09249b81a8f58d13a5366d66d1b80e86861ed949016c52ec614d1b694512a12304cbf2cb189f5f0fc705ba4ef937f1e7b710d4f0728a2916616505b3b603631fa80f47c364825dbf5f2f68cbff86cc1819254dc0bb642469099dfba0a0dce26ba82a569500ecc750a290c01cea7 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\14161423BF063DA707F158D4A7F9A1BCD6D11FD4 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\14161423BF063DA707F158D4A7F9A1BCD6D11FD4\Blob = 0200000000000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00370038003200370033004500430031002d0046003700390045002d0034003800380036002d0038003200360036002d003100370032003700320036003500320030004200450034007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f0076006900640065007200000023000000000000001400000014161423bf063da707f158d4a7f9a1bcd6d11fd4 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\FD79F49BE8A9CCDC18AE6006BACBDB076F313852 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3764 powershell.exe 3764 powershell.exe 4444 powershell.exe 4444 powershell.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 3764 powershell.exe Token: SeIncreaseQuotaPrivilege 3764 powershell.exe Token: SeSecurityPrivilege 3764 powershell.exe Token: SeTakeOwnershipPrivilege 3764 powershell.exe Token: SeLoadDriverPrivilege 3764 powershell.exe Token: SeSystemProfilePrivilege 3764 powershell.exe Token: SeSystemtimePrivilege 3764 powershell.exe Token: SeProfSingleProcessPrivilege 3764 powershell.exe Token: SeIncBasePriorityPrivilege 3764 powershell.exe Token: SeCreatePagefilePrivilege 3764 powershell.exe Token: SeBackupPrivilege 3764 powershell.exe Token: SeRestorePrivilege 3764 powershell.exe Token: SeShutdownPrivilege 3764 powershell.exe Token: SeDebugPrivilege 3764 powershell.exe Token: SeSystemEnvironmentPrivilege 3764 powershell.exe Token: SeRemoteShutdownPrivilege 3764 powershell.exe Token: SeUndockPrivilege 3764 powershell.exe Token: SeManageVolumePrivilege 3764 powershell.exe Token: 33 3764 powershell.exe Token: 34 3764 powershell.exe Token: 35 3764 powershell.exe Token: 36 3764 powershell.exe Token: SeDebugPrivilege 4504 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeIncreaseQuotaPrivilege 4444 powershell.exe Token: SeSecurityPrivilege 4444 powershell.exe Token: SeTakeOwnershipPrivilege 4444 powershell.exe Token: SeLoadDriverPrivilege 4444 powershell.exe Token: SeSystemProfilePrivilege 4444 powershell.exe Token: SeSystemtimePrivilege 4444 powershell.exe Token: SeProfSingleProcessPrivilege 4444 powershell.exe Token: SeIncBasePriorityPrivilege 4444 powershell.exe Token: SeCreatePagefilePrivilege 4444 powershell.exe Token: SeBackupPrivilege 4444 powershell.exe Token: SeRestorePrivilege 4444 powershell.exe Token: SeShutdownPrivilege 4444 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeSystemEnvironmentPrivilege 4444 powershell.exe Token: SeRemoteShutdownPrivilege 4444 powershell.exe Token: SeUndockPrivilege 4444 powershell.exe Token: SeManageVolumePrivilege 4444 powershell.exe Token: 33 4444 powershell.exe Token: 34 4444 powershell.exe Token: 35 4444 powershell.exe Token: 36 4444 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4504 wrote to memory of 3764 4504 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe 84 PID 4504 wrote to memory of 4444 4504 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe"1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.InterfaceDescription -like '*TAP-Windows*'} | Select-Object -Property Name, InterfaceDescription, Status"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "Get-PnpDevice | Where-Object {$_.FriendlyName -like '*TAP-Windows*' -or $_.InstanceId -like '*tap0901*'} | Select-Object -Property FriendlyName, Status"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 417c4cb2b29babf944e6c41ea1b362908782127c5894ef0fe3372abc855fbfd3
- MD5 6103fe5d5027cab041f301df51eac4c4
- SHA1 c657565a144127c840a918019386d0215fd8c344
- SHA512 6a2ec9fb27a748a8de37064cca4464dbe2758b0711e6622c8ff6f2dccd8b332d933abc8014dfe22e0a86659211fc7c394d9ccbf965d1f253e4cf59ebb290d9cd
- TLSH T16271ED323275B0D4C9567F072A2819D063BF4396EA94AF5CB25C621ED92751B8F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fb0dba3b5d24d64a3eac78efc37992a20994880248acf9ea140842b6ba2f2a6f
- MD5 e73cb57661f1933ef74548eaba5e9254
- SHA1 b42f6bb99150349442399b8031bc6b159cf06329
- SHA512 1cb3ef54d592fe532f6d52f7d0560698ae7abefac591ed909cd973de475007c83cbf02cd355c500dd4f11e4a81a14e9ef14a7486f96a212010d49b18a8182456
- TLSH T168216527B3DD8921DC9A123A109D9C1076B683C7809ECF9F6AC0D615A07FAD8CB31194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp391C.tmp
- Size 2KB
- SHA256 c84b04b87e877e3905724bed61439699eee97f60ce1c0b1a391dfd1dee26b72d
- MD5 5b7342ef8193f57809f119bbb1425891
- SHA1 fa77621a1eaad6ad0e137276593b12d850284acc
- SHA512 70b1a577fc11ec4f2f7b3b908f7408c036055c0265b99831d5cc7ef0bcf90d4a96878ce8fc91afbaeba37988b1cc193a2b3450f278c73c593794cd3c58f7f55d
- TLSH T1FB51F803B9BB4458365D1FFF3890AF1955D9CB002D75C4C7B7B022ED8815EA5A674207
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_443lhjf2.iyo.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH