1bc8e3775f9c71c87c94999a648f1f377c50a1aff979f51c6bc96c2d31576345

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe
Size 6.2MB
Sample260522-ezzzfshs4s
SHA256 1bc8e3775f9c71c87c94999a648f1f377c50a1aff979f51c6bc96c2d31576345
MD5 e487c3bf87196e9b3ec9e656bed06197
SHA1 9792ed8a9cf98266a1dcc8ade30dc123b3b08656
SHA512 d19c3b98dbc80fcad499ba11438a53feb1eb2fc14a47e0c870057f77b7bad019e3d11979d078aa02c8657b3e34ce2128d529cd6a47bb04e090a48678210ac489
SSDEEP 49152:SQLFnB3N4W4ROFkoVFuPQCQpINjWEFFIdjEfii7nbb+KnCDBzNH5diEs3k9quZnt:FF0fOJralAGbeljs0Jw05ZR+bD
TLSH
T14D665A03F2A581E8C0AEC174835AA733FA32B8895535B65F5BE0CB212F25F509F1E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4344	defender.exe
396	defender.exe
1288	defender.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\defender.exe"	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\defender.exe"	defender.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	cmstp.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe	defender.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe	defender.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	cmstp.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	cmstp.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2624	sc.exe
4164	sc.exe
3160	sc.exe
1792	sc.exe
4572	sc.exe
680	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming\\defender.exe"	defender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Network Connections	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	cmstp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	defender.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2160	schtasks.exe
2352	schtasks.exe
2444	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1720	3948	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	86
PID 3948 wrote to memory of 2160	3948	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	91
PID 3948 wrote to memory of 4164	3948	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	92
PID 4344 wrote to memory of 2492	4344	defender.exe	97
PID 3948 wrote to memory of 3160	3948	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	98
PID 3948 wrote to memory of 3652	3948	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	99
PID 396 wrote to memory of 3368	396	defender.exe	102
PID 4344 wrote to memory of 2352	4344	defender.exe	104
PID 4344 wrote to memory of 1792	4344	defender.exe	105
PID 396 wrote to memory of 2444	396	defender.exe	108
PID 396 wrote to memory of 4572	396	defender.exe	109
PID 5088 wrote to memory of 868	5088	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	114
PID 1288 wrote to memory of 3420	1288	defender.exe	116
PID 4344 wrote to memory of 680	4344	defender.exe	117
PID 4344 wrote to memory of 4500	4344	defender.exe	118
PID 396 wrote to memory of 2624	396	defender.exe	120
PID 396 wrote to memory of 2264	396	defender.exe	121
PID 5088 wrote to memory of 696	5088	2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe	123
PID 1288 wrote to memory of 4264	1288	defender.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3948
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\3STfexVrfPg4kJqY.inf
  2⤵
  PID:1720
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn WindowsDefender /tr C:\Users\Admin\AppData\Roaming\defender.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2160
- C:\Windows\system32\sc.exe
  "sc" create WindowsDefender binPath= C:\Users\Admin\AppData\Roaming\defender.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4164
- C:\Windows\system32\sc.exe
  "sc" start WindowsDefender
  2⤵
  - Launches sc.exe
  PID:3160
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\Vy9idUB4VYGKOQra.inf
  2⤵
  PID:3652

C:\Users\Admin\AppData\Roaming\defender.exe
C:\Users\Admin\AppData\Roaming\defender.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4344
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\4ToSAwHBfmRlrI0m.inf
  2⤵
  PID:2492
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn WindowsDefender /tr C:\Users\Admin\AppData\Roaming\defender.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2352
- C:\Windows\system32\sc.exe
  "sc" create WindowsDefender binPath= C:\Users\Admin\AppData\Roaming\defender.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1792
- C:\Windows\system32\sc.exe
  "sc" start WindowsDefender
  2⤵
  - Launches sc.exe
  PID:680
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\G3PGjmc3BunyuPWv.inf
  2⤵
  PID:4500

C:\Users\Admin\AppData\Roaming\defender.exe
C:\Users\Admin\AppData\Roaming\defender.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:396
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\eUE1rKwWyTEtQV4f.inf
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn WindowsDefender /tr C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2444
- C:\Windows\system32\sc.exe
  "sc" create WindowsDefender binPath= C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe start= auto
  2⤵
  - Launches sc.exe
  PID:4572
- C:\Windows\system32\sc.exe
  "sc" start WindowsDefender
  2⤵
  - Launches sc.exe
  PID:2624
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\itzv3Kpi193gzjEI.inf
  2⤵
  PID:2264

C:\Users\Admin\AppData\Local\Temp\2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe
C:\Users\Admin\AppData\Local\Temp\2026-05-22_e487c3bf87196e9b3ec9e656bed06197_akira_glassworm_quasar-rat.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\ikPFpBYBOWOOLZzH.inf
  2⤵
  PID:868
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\itgjGuoVqSQ8QNv5.inf
  2⤵
  PID:696

C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe
C:\Windows\system32\config\systemprofile\AppData\Roaming\defender.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\wJOD2QY8PZaEw92q.inf
  2⤵
  PID:3420
- \??\c:\Windows\System32\cmstp.exe
  "c:\Windows\System32\cmstp.exe" /au c:\windows\temp\xbWwcEcdoZn1XsLX.inf
  2⤵
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dir.sqlite3

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir.sqlite3
Size 64KB
SHA256 91670e5d7ac658396db97be8cfe77dda09da6539bd0d69bb9188c5801d67c44a
MD5 6c8743d165c64e1b0f892000732273ea
SHA1 cf7c7fcbed71505bfded062eab734638fb5d3735
SHA512 8939c80988ed5d0e06a921dafb39e236b8ab2819aabea8a17c5ff630661b6163796b75c57c0007ab637313449a90c364486842a249538b9fa095263c745edaff
SSDEEP 48:T/t5cvCs4TbF3Kl31rMNuDsMHNBjEu5596YQ7IRcFJVNw1kV/v74CI:Bj7HFaPQN67NrbgYQLb/tUCI
TLSH
T1EE53DB9F5FA83220C8A001B3ADD15C63293C875F4B53BDE071E840C5EFCA9696078CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dir.sqlite3

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir.sqlite3
Size 100KB
SHA256 d631e04e60fd5587b46cfc79623a2280e227cc97f5081efcdf6b8cdc3dc917c6
MD5 cb0e9938b1c8e34cfb05404dbc4c1b15
SHA1 bfbfa45f140c5787ed9722364d26e27b03d1c2ed
SHA512 2ecbc17f52ec6e09f0991349bd4a7b906b8a0888561f254389df8a1f40980b253834d447a4360481fd54e52ecb01bd1068dc795db00a75973f2c67ba80f0ad0a
SSDEEP 768:S3ZAXO0BuRfhZgDs9kZux1b2M/tpEuv2bwygK:SqXOuuNhZgDsJrELkygK
TLSH
T148A37D6A0E643DF4C056C235EC9B16CAEF34536F17E6388032E0209BFF4395A966E579
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

con_microdesc_sha3-256-0e821c4310fc3aa9b648832113fc9b15815ffedeb8afc4e24e31fe6ef2816312

Path C:\Users\Admin\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-0e821c4310fc3aa9b648832113fc9b15815ffedeb8afc4e24e31fe6ef2816312
Size 3.4MB
SHA256 2ea998b398ce6d99df64f646aa053c4f11fba1171544e7773fc6835baf718cea
MD5 9d7902be66836facf655552dfde300a8
SHA1 3df54d088fbf8cb85487945df3a176e623448dbe
SHA512 5f3a9c8b9a21d621880baa6a3af4641104698e3e3959dd868cf364747c2806cb1771e2ad635363ab5dc549510b1b275ec327bc752ef71963b2e4ddd9547f956a
SSDEEP 12288:CmVPWvZsOeWYIvb6SjbNk44UP9MeODyBODOHvtDP6KrhuGICYTakhVaY+ZDowTDE:kvyOeRMpkxa9qnOVDP68uGM2kDI+jn7h
TLSH
T189F554EA97124EEED22609DBE510FB7BF33F2725C2486B94296F8CFA7205091751093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

circuit_timeouts.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\circuit_timeouts.json
Size 451B
SHA256 795ec3e3ddd233b66c1d24775e762f57d67e66afc878e565ff2dd8cedd948426
MD5 d8ad9f1cdd669a97b70b007d74a3ffdb
SHA1 e6431b20bc7e3627cb749be68c5a1707055aa77c
SHA512 67254670c840e2b5cf6a82909655b8ba41f2d89e2286019796f036283289e5011bb9acb585527e3fe75e415557e507bc5d7509d125182cd8f1012d04389a532a
TLSH
T118F0FE12800A029558888734902CC38E9508D9433C7D7F44363E0E442F7F11C0FBD028
MD5 SHA1 SHA512 TLSH

Submit Download

circuit_timeouts.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\circuit_timeouts.json
Size 65B
SHA256 9dbe12675e515f32f07aea11cc9f8bea69b3f143b3d825d98ca1ef41b2988ee7
MD5 b2b738c82cdfbf56440274e03a50c9f8
SHA1 5c1a0274017a666f069980c3c5a6220026cd3336
SHA512 d4c9dbca06de019b7ea2519e24ad603d6283c3f0aa7f9d97b9b014861f54d9cfb4f6a295b48d6bf69f2ee122668709df175afcf8f90b0e7e67a3e643f28e84e8
TLSH
T103A02220C0A200B3E0C023300222C3C88F20EF0232A23208300F0C0C02883A8033A222
MD5 SHA1 SHA512 TLSH

Submit Download

guards.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.json
Size 9KB
SHA256 df2fb28aa18f373acca0d6a7b514e33c80408aece979da1cf3613223ba3da1a3
MD5 2713bdd8066fe21623993bb406be16bb
SHA1 4b3390f7bd087b76a960545b78c4f0a4a6ef1120
SHA512 02fb53f7b9adb1f7a8150cc22781b3431ee2a8d3c1cd272e44ddb794e7af7afa0c205dfa3e17a3d8a84f367e33322f8b06903a5eaa716ce5646b5ca260011ac3
SSDEEP 192:ZH3HA9H+VHyTAHJZHnfHiH1sHujLnHyH83oHNHWHEiHKH5HfHBu2HMHuU2:ZXg9eVScXHfC6O/Sc3ot2/qZ/U2si
TLSH
T1BA229D55CC762C8316DD963D846652C2D325A24B7E6E3C143F5E568C0F0D1AD0B3ABAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guards.json

Path C:\Users\Admin\AppData\Local\torproject\Arti\data\state\guards.json
Size 121B
SHA256 a2c2287ea6aa4ba07c2c1ab66268828c011a5d9cacef6dba1179a6bd196c2c3d
MD5 bd45eb55dc8a46aa313e7f68dd9cf953
SHA1 c6b7653ca38370cd639678a925802d1cd8a282eb
SHA512 058ffd60fa2aa2ab14022c0628d72a47440ad99bdfc82f8e6a4e303febde74514bda8e3064c015f57c63760462ca1193ee858040ce85cf8182d638d888e9cb71
TLSH
T1C3B09276A87B4C1611C0562A88382283E30128F3658CBC2E34CF450C0B4D0349DB5188
MD5 SHA1 SHA512 TLSH

Submit Download

defender.exe

Path C:\Users\Admin\AppData\Roaming\defender.exe
Size 6.2MB
SHA256 1bc8e3775f9c71c87c94999a648f1f377c50a1aff979f51c6bc96c2d31576345
MD5 e487c3bf87196e9b3ec9e656bed06197
SHA1 9792ed8a9cf98266a1dcc8ade30dc123b3b08656
SHA512 d19c3b98dbc80fcad499ba11438a53feb1eb2fc14a47e0c870057f77b7bad019e3d11979d078aa02c8657b3e34ce2128d529cd6a47bb04e090a48678210ac489
SSDEEP 49152:SQLFnB3N4W4ROFkoVFuPQCQpINjWEFFIdjEfii7nbb+KnCDBzNH5diEs3k9quZnt:FF0fOJralAGbeljs0Jw05ZR+bD
TLSH
T14D665A03F2A581E8C0AEC174835AA733FA32B8895535B65F5BE0CB212F25F509F1E759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3STfexVrfPg4kJqY.inf

Path \??\c:\windows\temp\3STfexVrfPg4kJqY.inf
Size 671B
SHA256 e055e3fa9cd24b91221a5b8a8f890de5a111bd5ee26b220d531864c130d266d8
MD5 66283966d07f70a9ce3357c0f696ab3c
SHA1 fd37f8d189026118fbc17763e84eea5116a238e7
SHA512 229132f3ed4f6ac125de754f412bfbf5ef96864508f9876fb1dc4d4b4456352d30d5e63375ddd9034ad944cfacb6233a2e878e120906a384cbd9bec745729a31
TLSH
T10601281C0CBBB002681A7710559705A0DFB2510436D15600F6F5DD141A7FB4F41CF36F
MD5 SHA1 SHA512 TLSH

Submit Download

4ToSAwHBfmRlrI0m.inf

Path \??\c:\windows\temp\4ToSAwHBfmRlrI0m.inf
Size 606B
SHA256 335cb3c398f27c39abb5002596bc5189cabb5282ccf8ceda50dc8ca7dd4ea96b
MD5 2a7592f3d093dd5ac173461786634a2d
SHA1 256f9221e9d1393ab928dd28677be5f6382708d4
SHA512 a8ba906ce4d32add222f6551ee6ac2fbd504ae221b7c81a9d66163fd25ac8a57e9c74c98657e8ff7bc297765c6d76a914f5609a4a954d61fefbef543c58695ac
TLSH
T190F0020C0CBF6002691A272029AB05609BF3420035845600F6F5AC102A7E74D82CF32F
MD5 SHA1 SHA512 TLSH

Submit Download

wJOD2QY8PZaEw92q.inf

Path \??\c:\windows\temp\wJOD2QY8PZaEw92q.inf
Size 632B
SHA256 0ec08cda0760d14a3bc3d0cf818876fd90ac27066d86cd2c7fe6a606a5acf761
MD5 fa7aa1006b01db5066d6724abf201a82
SHA1 8d797d45977255a57570b49663dd380e522025ab
SHA512 25caab247e6290634ff122ef9b7c358e4f1ddd1cd2b074fd159bcccfe0da9c99721a7b0572db2ddfe1acd0fde370b06e57fc97096af318b0b2e70a68a416b36a
TLSH
T1EFF0DD0C0DBF6052692A6B20659B0A60AFB6A21135804600B5F5AC652A6E74E839BB7F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-29-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/1288-127-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-109-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-114-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-124-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-105-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-91-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-101-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-131-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/1288-31-0x00007FF6C3550000-0x00007FF6C3B87000-memory.dmp

Download

memory/3948-71-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-97-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-102-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-128-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-112-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-123-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-106-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-23-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/3948-110-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/4344-119-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-73-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-111-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-28-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-107-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-129-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-103-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-125-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/4344-99-0x00007FF61F240000-0x00007FF61F877000-memory.dmp

Download

memory/5088-122-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-90-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-108-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-100-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-126-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-69-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-30-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-104-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-130-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

memory/5088-113-0x00007FF716E90000-0x00007FF7174C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads