Analysis
- max time kernel
149s - max time network
163s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 02:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe
- Size 103.5MB
- Sample260517-clltkaft5q
- SHA256 7429f69e65344569ba74cc2a31369ecca9d6d32966c8750c649b58649659eb18
- MD5 8ecd1d18faa9ca6b48a01a9ce4629f57
- SHA1 2295565f0e9ce5b1c697ab62733ff6a6d3567006
- SHA512 44e17de3edbd98f0a9eb31680e5a089c7a0f1c20b1298d59123cf88c732a48a15678add77ee99c28ad0f70ee5fa5922e8eb5c394276787f32d6f214e44bea221
- SSDEEP 786432:5gsHdMiOAx9EeCUV5OtsFRta9dMf9JrGIeie9b2ihM:LHdMiRx+TU3SKeIeiwSihM
- TLSH T1F5389D15B3E80B06D67FC27CC6639212E7B2B4431361C6CF0598DA993F53BD1AA36276
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 3412 powershell.exe 5764 powershell.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960\Blob = 0200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00460045004300350036003300320039002d0036004200310043002d0034004600430045002d0042003300440031002d003500320038004600430039003900450042003600450042007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000b000000010000002800000053006b0069006c006c0045007600610064006500200043006f0072006500200041005000490000000300000001000000140000009094ff1c05a92dacaf45ed0ab18ea9f0bdb9896020000000010000007a030000308203763082025ea00302010202085b83d5e845952dd0300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323633365a170d3331303532303132323633365a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100b6f469607db2e5f0cb7e3710fb8e4de1c5b2a3cf0b5a921618693e15c5ece5118a12e0c279858cf3126e6d0b1927e0a4913b227b8754ca73d45145a303af94828326f20078a557d17109cde009262b48df19ad233e397158d747dbfa69feb61dd27ca65df2cbb3825f0eb566852a92bc58546a31f6eb633b090e1f8e1cdcc85d1f7fe0bfd31128422f84e1bd5c999303dd3d1b31037a38ecde29016845032df9b2f33f4161bf8e289755c00334c1544cb2320c40dcfc4b429707f0bda97f8b44df5d9de5e4e5eee88e7355a41408c21fd083bc1b854f8be202f7cf4805ed7d6bc3c276319fca37fb798ba44ba282e2e9b92b0233f369e5093a21c426e0020b7d0203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100b59879b40e8bfb7e965c0475371fe3e707efc4c4382677e10d542f130898ccd32689a3b5fe65248a372b3c46c07c3a1c0d16aa20d38beea2713a4467d8cc1155f939fda9c74eeac93d4f5ef7e724877fc5810e719f32ec0013a34a23a334f39f83abcf2d673a68d269356a16dbf96a436ed1373b73f778b388c645122955aa42e0fe62815b6c621819b36a0ce29b12735177a4a575253f13fc0920d632062bb69579e64ede0a3011721867854d7569f63df3b01d80763f9fe2ada4247880318673d68a83084aa38d3be13e79c195840aa13e0289fdc7a37664743a0cb623b70a999b322137b92b087cc9616a51d20a48e125bcf7955442754edef4bf0a549413 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960\Blob = 0f0000000100000020000000c3848792d5a364c42d248dec07fdd2c57ede4ddfe9eba506b7613fcf903307ec0300000001000000140000009094ff1c05a92dacaf45ed0ab18ea9f0bdb989600b000000010000002800000053006b0069006c006c0045007600610064006500200043006f0072006500200041005000490000000200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00460045004300350036003300320039002d0036004200310043002d0034004600430045002d0042003300440031002d003500320038004600430039003900450042003600450042007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f0076006900640065007200000020000000010000007a030000308203763082025ea00302010202085b83d5e845952dd0300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323633365a170d3331303532303132323633365a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100b6f469607db2e5f0cb7e3710fb8e4de1c5b2a3cf0b5a921618693e15c5ece5118a12e0c279858cf3126e6d0b1927e0a4913b227b8754ca73d45145a303af94828326f20078a557d17109cde009262b48df19ad233e397158d747dbfa69feb61dd27ca65df2cbb3825f0eb566852a92bc58546a31f6eb633b090e1f8e1cdcc85d1f7fe0bfd31128422f84e1bd5c999303dd3d1b31037a38ecde29016845032df9b2f33f4161bf8e289755c00334c1544cb2320c40dcfc4b429707f0bda97f8b44df5d9de5e4e5eee88e7355a41408c21fd083bc1b854f8be202f7cf4805ed7d6bc3c276319fca37fb798ba44ba282e2e9b92b0233f369e5093a21c426e0020b7d0203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100b59879b40e8bfb7e965c0475371fe3e707efc4c4382677e10d542f130898ccd32689a3b5fe65248a372b3c46c07c3a1c0d16aa20d38beea2713a4467d8cc1155f939fda9c74eeac93d4f5ef7e724877fc5810e719f32ec0013a34a23a334f39f83abcf2d673a68d269356a16dbf96a436ed1373b73f778b388c645122955aa42e0fe62815b6c621819b36a0ce29b12735177a4a575253f13fc0920d632062bb69579e64ede0a3011721867854d7569f63df3b01d80763f9fe2ada4247880318673d68a83084aa38d3be13e79c195840aa13e0289fdc7a37664743a0cb623b70a999b322137b92b087cc9616a51d20a48e125bcf7955442754edef4bf0a549413 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe - Modifies system certificate store 2 TTPs 7 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960\Blob = 1400000001000000140000006bba2a6e75a3569892d20de09ae55992a879f1ff0b000000010000002800000053006b0069006c006c0045007600610064006500200043006f0072006500200041005000490000000200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00460045004300350036003300320039002d0036004200310043002d0034004600430045002d0042003300440031002d003500320038004600430039003900450042003600450042007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000300000001000000140000009094ff1c05a92dacaf45ed0ab18ea9f0bdb9896020000000010000007a030000308203763082025ea00302010202085b83d5e845952dd0300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323633365a170d3331303532303132323633365a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100b6f469607db2e5f0cb7e3710fb8e4de1c5b2a3cf0b5a921618693e15c5ece5118a12e0c279858cf3126e6d0b1927e0a4913b227b8754ca73d45145a303af94828326f20078a557d17109cde009262b48df19ad233e397158d747dbfa69feb61dd27ca65df2cbb3825f0eb566852a92bc58546a31f6eb633b090e1f8e1cdcc85d1f7fe0bfd31128422f84e1bd5c999303dd3d1b31037a38ecde29016845032df9b2f33f4161bf8e289755c00334c1544cb2320c40dcfc4b429707f0bda97f8b44df5d9de5e4e5eee88e7355a41408c21fd083bc1b854f8be202f7cf4805ed7d6bc3c276319fca37fb798ba44ba282e2e9b92b0233f369e5093a21c426e0020b7d0203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100b59879b40e8bfb7e965c0475371fe3e707efc4c4382677e10d542f130898ccd32689a3b5fe65248a372b3c46c07c3a1c0d16aa20d38beea2713a4467d8cc1155f939fda9c74eeac93d4f5ef7e724877fc5810e719f32ec0013a34a23a334f39f83abcf2d673a68d269356a16dbf96a436ed1373b73f778b388c645122955aa42e0fe62815b6c621819b36a0ce29b12735177a4a575253f13fc0920d632062bb69579e64ede0a3011721867854d7569f63df3b01d80763f9fe2ada4247880318673d68a83084aa38d3be13e79c195840aa13e0289fdc7a37664743a0cb623b70a999b322137b92b087cc9616a51d20a48e125bcf7955442754edef4bf0a549413 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6BBA2A6E75A3569892D20DE09AE55992A879F1FF 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6BBA2A6E75A3569892D20DE09AE55992A879F1FF\Blob = 0200000000000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00460045004300350036003300320039002d0036004200310043002d0034004600430045002d0042003300440031002d003500320038004600430039003900450042003600450042007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000002300000000000000140000006bba2a6e75a3569892d20de09ae55992a879f1ff 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\9094FF1C05A92DACAF45ED0AB18EA9F0BDB98960\Blob = 0300000001000000140000009094ff1c05a92dacaf45ed0ab18ea9f0bdb989600200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00460045004300350036003300320039002d0036004200310043002d0034004600430045002d0042003300440031002d003500320038004600430039003900450042003600450042007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000b000000010000002800000053006b0069006c006c0045007600610064006500200043006f00720065002000410050004900000020000000010000007a030000308203763082025ea00302010202085b83d5e845952dd0300d06092a864886f70d01010b05003049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f7374301e170d3236303531393132323633365a170d3331303532303132323633365a3049310b30090603550406130244453111300f060355040b1308536563757269747931133011060355040a130a536b696c6c457661646531123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100b6f469607db2e5f0cb7e3710fb8e4de1c5b2a3cf0b5a921618693e15c5ece5118a12e0c279858cf3126e6d0b1927e0a4913b227b8754ca73d45145a303af94828326f20078a557d17109cde009262b48df19ad233e397158d747dbfa69feb61dd27ca65df2cbb3825f0eb566852a92bc58546a31f6eb633b090e1f8e1cdcc85d1f7fe0bfd31128422f84e1bd5c999303dd3d1b31037a38ecde29016845032df9b2f33f4161bf8e289755c00334c1544cb2320c40dcfc4b429707f0bda97f8b44df5d9de5e4e5eee88e7355a41408c21fd083bc1b854f8be202f7cf4805ed7d6bc3c276319fca37fb798ba44ba282e2e9b92b0233f369e5093a21c426e0020b7d0203010001a3623060300e0603551d0f0101ff0404030205a030200603551d250101ff0416301406082b0601050507030106082b06010505070302302c0603551d110425302382096c6f63616c686f737487047f000001871000000000000000000000000000000001300d06092a864886f70d01010b05000382010100b59879b40e8bfb7e965c0475371fe3e707efc4c4382677e10d542f130898ccd32689a3b5fe65248a372b3c46c07c3a1c0d16aa20d38beea2713a4467d8cc1155f939fda9c74eeac93d4f5ef7e724877fc5810e719f32ec0013a34a23a334f39f83abcf2d673a68d269356a16dbf96a436ed1373b73f778b388c645122955aa42e0fe62815b6c621819b36a0ce29b12735177a4a575253f13fc0920d632062bb69579e64ede0a3011721867854d7569f63df3b01d80763f9fe2ada4247880318673d68a83084aa38d3be13e79c195840aa13e0289fdc7a37664743a0cb623b70a999b322137b92b087cc9616a51d20a48e125bcf7955442754edef4bf0a549413 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5764 powershell.exe 5764 powershell.exe 3412 powershell.exe 3412 powershell.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 5764 powershell.exe Token: SeIncreaseQuotaPrivilege 5764 powershell.exe Token: SeSecurityPrivilege 5764 powershell.exe Token: SeTakeOwnershipPrivilege 5764 powershell.exe Token: SeLoadDriverPrivilege 5764 powershell.exe Token: SeSystemProfilePrivilege 5764 powershell.exe Token: SeSystemtimePrivilege 5764 powershell.exe Token: SeProfSingleProcessPrivilege 5764 powershell.exe Token: SeIncBasePriorityPrivilege 5764 powershell.exe Token: SeCreatePagefilePrivilege 5764 powershell.exe Token: SeBackupPrivilege 5764 powershell.exe Token: SeRestorePrivilege 5764 powershell.exe Token: SeShutdownPrivilege 5764 powershell.exe Token: SeDebugPrivilege 5764 powershell.exe Token: SeSystemEnvironmentPrivilege 5764 powershell.exe Token: SeRemoteShutdownPrivilege 5764 powershell.exe Token: SeUndockPrivilege 5764 powershell.exe Token: SeManageVolumePrivilege 5764 powershell.exe Token: 33 5764 powershell.exe Token: 34 5764 powershell.exe Token: 35 5764 powershell.exe Token: 36 5764 powershell.exe Token: SeDebugPrivilege 3560 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeIncreaseQuotaPrivilege 3412 powershell.exe Token: SeSecurityPrivilege 3412 powershell.exe Token: SeTakeOwnershipPrivilege 3412 powershell.exe Token: SeLoadDriverPrivilege 3412 powershell.exe Token: SeSystemProfilePrivilege 3412 powershell.exe Token: SeSystemtimePrivilege 3412 powershell.exe Token: SeProfSingleProcessPrivilege 3412 powershell.exe Token: SeIncBasePriorityPrivilege 3412 powershell.exe Token: SeCreatePagefilePrivilege 3412 powershell.exe Token: SeBackupPrivilege 3412 powershell.exe Token: SeRestorePrivilege 3412 powershell.exe Token: SeShutdownPrivilege 3412 powershell.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeSystemEnvironmentPrivilege 3412 powershell.exe Token: SeRemoteShutdownPrivilege 3412 powershell.exe Token: SeUndockPrivilege 3412 powershell.exe Token: SeManageVolumePrivilege 3412 powershell.exe Token: 33 3412 powershell.exe Token: 34 3412 powershell.exe Token: 35 3412 powershell.exe Token: 36 3412 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3560 wrote to memory of 5764 3560 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe 81 PID 3560 wrote to memory of 3412 3560 2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_8ecd1d18faa9ca6b48a01a9ce4629f57_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_stealc_vidar_zxxz.exe"1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.InterfaceDescription -like '*TAP-Windows*'} | Select-Object -Property Name, InterfaceDescription, Status"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "Get-PnpDevice | Where-Object {$_.FriendlyName -like '*TAP-Windows*' -or $_.InstanceId -like '*tap0901*'} | Select-Object -Property FriendlyName, Status"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
- MD5 9f3107a91c0a75eb75418f89fe7dcbcd
- SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
- SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
- TLSH T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 931ebe105c3d0e5bd38925c2b2d0e67b5dce138ddb16cdb9bc1bb62bf3bf06b5
- MD5 cab626bc6bf51892df5743b1f6abcf3e
- SHA1 015cfd9fe61eeb3907999762bbd387a0afa36b46
- SHA512 3c5ea8a753991e14614c2051710a331861a839e1fb842410610219235db942189473db5abc803b88ab73f3a5849491870ca994743b1e37fa67de271a7b517258
- TLSH T19C216533B3ECC125C8D9117A208CAD00B2B5C3C7449F8F8B7A84C619957FADADB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp7673.tmp
- Size 2KB
- SHA256 908b3bb5a2de9d9b350cc9fcaac43186dc412758724b7eca2d0a5d2ce258bb45
- MD5 dab5c61bf7f1308a2f74d8f31c7dadd9
- SHA1 7444cb3ff9ddd89d199ef11c5c65d8c9050045e4
- SHA512 44829f559d4eac9494271178caeb1bc18be3f13f50f56830364d6fb38bbcb11fd8de02df5f82c7a5bc23f276007f1b92a11034e43dee56c07946595fa6098aff
- TLSH T136513B3A1228DD1034FBDDEAE26E1ED76C8EC3101D0C700FE435E8A5CD766719C46545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50gge513.pjx.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH