Overview

overview

10

Static

static

10

2026-07-05...om.exe

windows10-2004-x64

9

2026-07-05...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
  • Size 4.1MB
  • Sample260705-sd31wagx6j
  • SHA256 5f5fd8ca723da15f7d253f814d2a83d739f8f8f79e6236be3ae9b8a4a3d471d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Detects executables referencing combination of virtualization drivers 2 IoCs
  • Detects executables referencing virtualization MAC addresses 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 4 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 32 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare Tools registry key
    • Looks for VMWare drivers on disk
    • Looks for VMWare services registry key.
    • Looks for Xen service registry key.
    • Checks BIOS information in registry
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:4836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Windows\system32\tasklist.exe
      "tasklist" /FO CSV /NH
      2⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:1516
    • C:\Windows\system32\ipconfig.exe
      "ipconfig" /all
      2⤵
      • Gathers network information
      PID:1876
    • C:\Windows\system32\getmac.exe
      "getmac" /FO CSV /NH
      2⤵
        PID:5136
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" bios get manufacturer,version /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1140
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" cpu get numberofcores /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1356
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" diskdrive get model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:716
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_videocontroller get currenthorizontalresolution,currentverticalresolution /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2484
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get totalphysicalmemory /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2864
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get manufacturer,model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4272
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:4732
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" service get name /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3264
      • C:\Windows\system32\tasklist.exe
        "tasklist" /FO CSV /NH
        2⤵
        • Enumerates processes with tasklist
        PID:3284
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:6012
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object -ExpandProperty MainWindowTitle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4388
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-WmiObject Win32_Process -Filter 'ProcessId=4836' | Select -Expand ParentProcessId"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process -Id 3528 | Select -Expand Name"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1688
      • C:\Windows\system32\hostname.exe
        "hostname"
        2⤵
          PID:1812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Measure-Object | Select -Expand Count"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3660
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Create /TN 2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom /XML C:\Users\Admin\AppData\Local\Temp\svc_config.xml /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$s=New-Object -ComObject 'Wsaramt.C}ull';$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.lnk');$l.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$l.Save()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3176
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5440
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chrome.exe
          2⤵
          • Kills process with taskkill
          PID:4428
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM msedge.exe
          2⤵
          • Kills process with taskkill
          PID:4556
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM brave.exe
          2⤵
          • Kills process with taskkill
          PID:5960
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM opera.exe
          2⤵
          • Kills process with taskkill
          PID:5200
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM vivaldi.exe
          2⤵
          • Kills process with taskkill
          PID:4896
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM firefox.exe
          2⤵
          • Kills process with taskkill
          PID:996
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM browser.exe
          2⤵
          • Kills process with taskkill
          PID:4908
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM dragon.exe
          2⤵
          • Kills process with taskkill
          PID:5176
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coccoc.exe
          2⤵
          • Kills process with taskkill
          PID:1592
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chromium.exe
          2⤵
          • Kills process with taskkill
          PID:1872
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM torch.exe
          2⤵
          • Kills process with taskkill
          PID:3632
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM slimjet.exe
          2⤵
          • Kills process with taskkill
          PID:4344
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM centbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:2856
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM 360chrome.exe
          2⤵
          • Kills process with taskkill
          PID:236
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM qqbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:6012
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM sogouexplorer.exe
          2⤵
          • Kills process with taskkill
          PID:756
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM maxthon.exe
          2⤵
          • Kills process with taskkill
          PID:2748
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM ucbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:4880
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iron.exe
          2⤵
          • Kills process with taskkill
          PID:4772
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM amigo.exe
          2⤵
          • Kills process with taskkill
          PID:1092
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM orbitum.exe
          2⤵
          • Kills process with taskkill
          PID:2352
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avastbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:3964
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avgbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1980
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM blisk.exe
          2⤵
          • Kills process with taskkill
          PID:2012
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iridium.exe
          2⤵
          • Kills process with taskkill
          PID:5444
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM whale.exe
          2⤵
          • Kills process with taskkill
          PID:916
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM citrio.exe
          2⤵
          • Kills process with taskkill
          PID:5876
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coolnovo.exe
          2⤵
          • Kills process with taskkill
          PID:6108
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM icedragon.exe
          2⤵
          • Kills process with taskkill
          PID:5988
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM wave.exe
          2⤵
          • Kills process with taskkill
          PID:688
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM yandex.exe
          2⤵
          • Kills process with taskkill
          PID:4768
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM epic.exe
          2⤵
          • Kills process with taskkill
          PID:4240
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          2⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          PID:5488
        • C:\Windows\system32\getmac.exe
          "getmac" /fo csv /v
          2⤵
            PID:1576
          • C:\Windows\system32\tzutil.exe
            "tzutil" /g
            2⤵
              PID:5076
            • C:\Windows\system32\ipconfig.exe
              "ipconfig" /all
              2⤵
              • Gathers network information
              PID:4860
            • C:\Windows\system32\arp.exe
              "arp" -a
              2⤵
              • Network Service Discovery
              PID:4784
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_networkadapter get name,description,macaddress
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5612
            • C:\Windows\system32\netsh.exe
              "netsh" wlan show profiles
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:556
          • C:\Users\Admin\AppData\Local\Temp\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
            C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-05_847718130ec6019f1829b3ac37b08469_akira_cobalt-strike_glassworm_icedid_quasar-rat_rusty-stealer_satacom.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1244

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Virtualization/Sandbox Evasion

                7
                T1497

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                File and Directory Discovery

                2
                T1083

                Network Service Discovery

                1
                T1046

                Process Discovery

                1
                T1057

                Query Registry

                8
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Wi-Fi Discovery

                1
                T1016.002

                Virtualization/Sandbox Evasion

                7
                T1497

                Lateral Movement

                Collection

                Data from Local System

                3
                T1005

                Email Collection

                1
                T1114

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 19d4f5304a31f3615852de6c2c03ec8e6d792f28778c1c11f6ebc7fa9701e08e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 c3450f7fcf7deacd684aff39e3cfe0c63ad7630478796a7448b47d317098a242
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 01eb9ab30fcb6c22d0cfdce052e1a0a7261b074cd2954fae692a5c9d4a91a0e5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 291B
                • SHA256 20fdbd022e0b1203ef14e5fefabc8ddad87bb008a95b4fe4860b7cf2f8d308ff
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 0423240383d3e5c4c10fc9b86bb901bdec6bf5ee4c323b414cd11689599d3585
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                OULOMQXE_Admin_10.127.0.5_f8023b4a.zip
                • Path C:\Users\Admin\AppData\Local\Temp\OULOMQXE_Admin_10.127.0.5_f8023b4a.zip
                • Size 464KB
                • SHA256 80ea7802e2a9c2afb1934d3dff2144c45014171839c6efccc2d486c1c3eabbe9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_bfjmv0cv.mls.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfjmv0cv.mls.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                svc_config.xml
                • Path C:\Users\Admin\AppData\Local\Temp\svc_config.xml
                • Size 935B
                • SHA256 7a662ddcdbd27d88ccfeb5ee69cfbc4e64eef3aadbad03b593e0873004b3d0b0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1964-47-0x00007FF7A7CD0000-0x00007FF7A80F3000-memory.dmp
                Download

                memory/3384-63-0x00000246ECBE0000-0x00000246ECBEA000-memory.dmp
                Download

                memory/3384-59-0x00000246ECB90000-0x00000246ECB9A000-memory.dmp
                Download

                memory/3384-60-0x00000246ECBF0000-0x00000246ECC0C000-memory.dmp
                Download

                memory/3384-61-0x00000246ECBA0000-0x00000246ECBA8000-memory.dmp
                Download

                memory/3384-62-0x00000246ECBD0000-0x00000246ECBD6000-memory.dmp
                Download

                memory/3660-40-0x000001F9FE340000-0x000001F9FE35E000-memory.dmp
                Download

                memory/3660-39-0x000001F9FE000000-0x000001F9FE0B2000-memory.dmp
                Download

                memory/4836-0-0x00007FF7A7CD0000-0x00007FF7A80F3000-memory.dmp
                Download

                memory/4860-10-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-19-0x0000016160460000-0x000001616058F000-memory.dmp
                Download

                memory/4860-21-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-20-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-17-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-16-0x000001615FB40000-0x000001615FB4A000-memory.dmp
                Download

                memory/4860-14-0x00000161607E0000-0x00000161607FE000-memory.dmp
                Download

                memory/4860-15-0x0000016160800000-0x00000161608B2000-memory.dmp
                Download

                memory/4860-11-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-9-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-8-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-7-0x000001615FAF0000-0x000001615FB12000-memory.dmp
                Download

                memory/4860-4-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-3-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-2-0x00007FFA59250000-0x00007FFA59BF4000-memory.dmp
                Download

                memory/4860-1-0x00007FFA593DF000-0x00007FFA593E0000-memory.dmp
                Download