Overview

overview

10

Static

static

10

2026-07-05...om.exe

windows10-2004-x64

9

2026-07-05...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    33s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 22:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
  • Size 4.0MB
  • Sample260705-1x8dpsbx5j
  • SHA256 03418b5196affd9519c6eef53f4e0092fab19ac2f9da6ff59e4d0180a40b1c7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Detects executables referencing combination of virtualization drivers 2 IoCs
  • Detects executables referencing virtualization MAC addresses 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 4 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 26 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 32 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare Tools registry key
    • Looks for VMWare drivers on disk
    • Looks for VMWare services registry key.
    • Looks for Xen service registry key.
    • Checks BIOS information in registry
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:5892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:960
    • C:\Windows\system32\tasklist.exe
      "tasklist" /FO CSV /NH
      2⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:2856
    • C:\Windows\system32\ipconfig.exe
      "ipconfig" /all
      2⤵
      • Gathers network information
      PID:5004
    • C:\Windows\system32\getmac.exe
      "getmac" /FO CSV /NH
      2⤵
        PID:5496
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" bios get manufacturer,version /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4256
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" cpu get numberofcores /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3548
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" diskdrive get model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:760
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_videocontroller get currenthorizontalresolution,currentverticalresolution /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5592
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get totalphysicalmemory /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1076
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get manufacturer,model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2788
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:2368
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" service get name /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3472
      • C:\Windows\system32\tasklist.exe
        "tasklist" /FO CSV /NH
        2⤵
        • Enumerates processes with tasklist
        PID:52
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:2780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object -ExpandProperty MainWindowTitle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-WmiObject Win32_Process -Filter 'ProcessId=5892' | Select -Expand ParentProcessId"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process -Id 3508 | Select -Expand Name"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2764
      • C:\Windows\system32\hostname.exe
        "hostname"
        2⤵
          PID:1184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Measure-Object | Select -Expand Count"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:432
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Create /TN 2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom /XML C:\Users\Admin\AppData\Local\Temp\svc_config.xml /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$s=New-Object -ComObject 'Wsaramt.C}ull';$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.lnk');$l.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$l.Save()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2040
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5584
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4232
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chrome.exe
          2⤵
          • Kills process with taskkill
          PID:4676
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM msedge.exe
          2⤵
          • Kills process with taskkill
          PID:1696
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM brave.exe
          2⤵
          • Kills process with taskkill
          PID:2824
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM opera.exe
          2⤵
          • Kills process with taskkill
          PID:4140
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM vivaldi.exe
          2⤵
          • Kills process with taskkill
          PID:1144
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM firefox.exe
          2⤵
          • Kills process with taskkill
          PID:5536
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM browser.exe
          2⤵
          • Kills process with taskkill
          PID:5644
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM dragon.exe
          2⤵
          • Kills process with taskkill
          PID:1952
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coccoc.exe
          2⤵
          • Kills process with taskkill
          PID:6132
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chromium.exe
          2⤵
          • Kills process with taskkill
          PID:4224
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM torch.exe
          2⤵
          • Kills process with taskkill
          PID:2416
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM slimjet.exe
          2⤵
          • Kills process with taskkill
          PID:5348
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM centbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:5992
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM 360chrome.exe
          2⤵
          • Kills process with taskkill
          PID:5188
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM qqbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1156
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM sogouexplorer.exe
          2⤵
          • Kills process with taskkill
          PID:2080
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM maxthon.exe
          2⤵
          • Kills process with taskkill
          PID:3868
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM ucbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1672
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iron.exe
          2⤵
          • Kills process with taskkill
          PID:3060
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM amigo.exe
          2⤵
          • Kills process with taskkill
          PID:6020
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM orbitum.exe
          2⤵
          • Kills process with taskkill
          PID:4220
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avastbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1336
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avgbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1932
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM blisk.exe
          2⤵
          • Kills process with taskkill
          PID:2224
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iridium.exe
          2⤵
          • Kills process with taskkill
          PID:3268
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM whale.exe
          2⤵
          • Kills process with taskkill
          PID:1728
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM citrio.exe
          2⤵
          • Kills process with taskkill
          PID:2464
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coolnovo.exe
          2⤵
          • Kills process with taskkill
          PID:5136
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM icedragon.exe
          2⤵
          • Kills process with taskkill
          PID:1912
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM wave.exe
          2⤵
          • Kills process with taskkill
          PID:2436
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM yandex.exe
          2⤵
          • Kills process with taskkill
          PID:5516
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM epic.exe
          2⤵
          • Kills process with taskkill
          PID:3444
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          2⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          PID:1136
        • C:\Windows\system32\getmac.exe
          "getmac" /fo csv /v
          2⤵
            PID:5688
          • C:\Windows\system32\tzutil.exe
            "tzutil" /g
            2⤵
              PID:1972
            • C:\Windows\system32\ipconfig.exe
              "ipconfig" /all
              2⤵
              • Gathers network information
              PID:1704
            • C:\Windows\system32\arp.exe
              "arp" -a
              2⤵
              • Network Service Discovery
              PID:6024
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_networkadapter get name,description,macaddress
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:712
            • C:\Windows\system32\netsh.exe
              "netsh" wlan show profiles
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:5196
          • C:\Users\Admin\AppData\Local\Temp\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
            C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-05_99809c96a288be22824d5fccbda95ec2_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
            1⤵
            • Enumerates VirtualBox registry keys
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VirtualBox drivers on disk
            • Looks for VMWare drivers on disk
            • Checks BIOS information in registry
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:6000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1160

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Virtualization/Sandbox Evasion

                7
                T1497

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                File and Directory Discovery

                2
                T1083

                Network Service Discovery

                1
                T1046

                Process Discovery

                1
                T1057

                Query Registry

                8
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Wi-Fi Discovery

                1
                T1016.002

                Virtualization/Sandbox Evasion

                7
                T1497

                Lateral Movement

                Collection

                Data from Local System

                3
                T1005

                Email Collection

                1
                T1114

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 a925df12be0936cd25244b1264b3882b7c9be1f94228d096cd05f94c9bb6aa33
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 12011b3f0e93f81bc93d4c84fbc3ab738c0a39b4efc7ee9c7e37f20c49a6b399
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 f389cb1e61eee6c3bcbee3d2ed7d377b8a4fc0e77055366b51ce3856542b8ac3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 0423240383d3e5c4c10fc9b86bb901bdec6bf5ee4c323b414cd11689599d3585
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TUYTTRXL_Admin_10.127.0.26_86315760.zip
                • Path C:\Users\Admin\AppData\Local\Temp\TUYTTRXL_Admin_10.127.0.26_86315760.zip
                • Size 459KB
                • SHA256 820a23a9961165d216be0fd03326dad349cd42ab1ca5647288f1d132be3fcc72
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_xj55khga.ace.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xj55khga.ace.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                svc_config.xml
                • Path C:\Users\Admin\AppData\Local\Temp\svc_config.xml
                • Size 917B
                • SHA256 f4589300ec853b20a2069eb3268ab38254b574fc4711a0285c4d8c90a13fbf8c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/432-43-0x0000020FEA300000-0x0000020FEA31E000-memory.dmp
                Download

                memory/432-42-0x0000020FEA210000-0x0000020FEA2C2000-memory.dmp
                Download

                memory/960-23-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-1-0x00007FFB0AFDF000-0x00007FFB0AFE0000-memory.dmp
                Download

                memory/960-17-0x000001D7438C0000-0x000001D7438DE000-memory.dmp
                Download

                memory/960-18-0x000001D743B10000-0x000001D743BC2000-memory.dmp
                Download

                memory/960-19-0x000001D7438E0000-0x000001D7438EA000-memory.dmp
                Download

                memory/960-20-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-21-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-14-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-24-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-13-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-12-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-11-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-2-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-9-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-10-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-6-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-44-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-7-0x000001D743810000-0x000001D743832000-memory.dmp
                Download

                memory/960-3-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/960-8-0x00007FFB0AE50000-0x00007FFB0B7F4000-memory.dmp
                Download

                memory/5584-62-0x0000022E60A70000-0x0000022E60A7A000-memory.dmp
                Download

                memory/5584-64-0x0000022E60AD0000-0x0000022E60AEC000-memory.dmp
                Download

                memory/5584-65-0x0000022E60A80000-0x0000022E60A88000-memory.dmp
                Download

                memory/5584-66-0x0000022E60AB0000-0x0000022E60AB6000-memory.dmp
                Download

                memory/5584-67-0x0000022E60AC0000-0x0000022E60ACA000-memory.dmp
                Download

                memory/5892-0-0x00007FF6D2B50000-0x00007FF6D2F59000-memory.dmp
                Download

                memory/6000-55-0x00007FF6D2B50000-0x00007FF6D2F59000-memory.dmp
                Download