Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe
- Size 4.2MB
- Sample260812-wdevtscl6z
- SHA256 8233cc8398dee13ac7548ad7aab92b0655b40dfc0af60142d79b7a9d09acab23
- MD5 6ad4c1353e79e1d4fa7dde09dc67e831
- SHA1 cb83d3be1b2644be0489d03d8d2f13f0157da2b3
- SHA512 c699c5b85b38db5266577b7d13d694904604aa9f4d5fbb75932501bfd372a51c4d9ef13a529a160231fc86b498ce60bf9abfd29514b127337c54aa7913c81652
- SSDEEP 49152:X/v8lFhT2YXQTAv7lkO5DdGntR2lYooZaZ8Bqe6XyGaRDkZNUuHtWKBwFosu7SjP:XX8lF/Xv5DgtR2lYooq8MpyVoNUGijC
- TLSH T1111602033BFEB06EEA6B97B494A463454625FC770D51C18A35CC149B0F9B6407EBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 35 IoCs
resource yara_rule behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp family_salatstealer behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp family_salatstealer behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp family_salatstealer behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 35 IoCs
resource yara_rule behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 35 IoCs
resource yara_rule behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 35 IoCs
resource yara_rule behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 42 IoCs
resource yara_rule behavioral1/memory/3280-15-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-33-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp UPX behavioral1/memory/5044-71-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-90-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/4276-122-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp UPX behavioral1/memory/4276-142-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp UPX behavioral1/memory/1420-188-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 5044 dllhost.exe 4276 dllhost.exe 1420 dllhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral1/memory/3280-15-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-33-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-34-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-35-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-37-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-38-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-39-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-40-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-41-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-42-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-43-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/3280-50-0x0000000002F30000-0x0000000003B8C000-memory.dmp upx behavioral1/memory/5044-71-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-90-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-92-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-93-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-91-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-95-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-94-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-96-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-97-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-98-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-99-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-100-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-101-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/5044-105-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/4276-122-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/5044-125-0x0000000002CD0000-0x000000000392C000-memory.dmp upx behavioral1/memory/4276-142-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-146-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-149-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-151-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-150-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-145-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/4276-166-0x00000000035B0000-0x000000000420C000-memory.dmp upx behavioral1/memory/1420-188-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-226-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-227-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-228-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-230-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-229-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx behavioral1/memory/1420-234-0x00000000032B0000-0x0000000003F0C000-memory.dmp upx - Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\dllhost.exe 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe File opened for modification C:\Program Files\Google\Chrome\Application\dllhost.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe dllhost.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\e8213f6a-d93f-1eb7-150a-e7ff58686ad9 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\upfc.exe 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe File opened for modification C:\Program Files (x86)\Microsoft\e8213f6a-d93f-1eb7-150a-e7ff58686ad9 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3280 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 3280 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 3280 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 3280 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 4856 powershell.exe 4856 powershell.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe 5044 dllhost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4856 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3280 wrote to memory of 5044 3280 2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe 93 PID 5044 wrote to memory of 4856 5044 dllhost.exe 95 PID 5044 wrote to memory of 4276 5044 dllhost.exe 97 PID 5044 wrote to memory of 1420 5044 dllhost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_6ad4c1353e79e1d4fa7dde09dc67e831_akira_amadey_elex_glassworm.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Program Files (x86)\Microsoft\dllhost.exe"C:\Program Files (x86)\Microsoft\dllhost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Program Files\Google\Chrome\Application\dllhost.exe"C:\Program Files\Google\Chrome\Application\dllhost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\dllhost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1420
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5076
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:840
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2192
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\dllhost.exe
- Size 4.2MB
- SHA256 8233cc8398dee13ac7548ad7aab92b0655b40dfc0af60142d79b7a9d09acab23
- MD5 6ad4c1353e79e1d4fa7dde09dc67e831
- SHA1 cb83d3be1b2644be0489d03d8d2f13f0157da2b3
- SHA512 c699c5b85b38db5266577b7d13d694904604aa9f4d5fbb75932501bfd372a51c4d9ef13a529a160231fc86b498ce60bf9abfd29514b127337c54aa7913c81652
- SSDEEP 49152:X/v8lFhT2YXQTAv7lkO5DdGntR2lYooZaZ8Bqe6XyGaRDkZNUuHtWKBwFosu7SjP:XX8lF/Xv5DgtR2lYooq8MpyVoNUGijC
- TLSH T1111602033BFEB06EEA6B97B494A463454625FC770D51C18A35CC149B0F9B6407EBC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 f979fa7296f58783230fe57a53fdc3508ada9a33e0066b03e9c83bd4589e456d
- MD5 ea0ccb7b18e76c16df70870834ea7559
- SHA1 859cf174074fb8a4a979304f4dae520118ae7258
- SHA512 bce3774ec18d2de9bb8f3ddb704a9bbbe518ac44bf529334a9773f7c886698226a17c3ef3a0e8b80829427bbf5ae05792d36a502c50259076a1c94c8dca90f9e
- TLSH T1FC31060005A4E2EB48C1C572F4586DBE33539D9778572C1E8232B2CDE8C589BF349DB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 ff6d166e5878136dfae1e4b9e71635fc053a349eb97a1bac7251d975ab6c838b
- MD5 72119c916a552be02e9d84217098e018
- SHA1 2cd1c9c4c81c2c6a06b021db6320c902b624b316
- SHA512 3f55f6912176f870048a06f02fc79e711034329241270fd50f9a871569fad349d82fafe47ec173b88d5476e9771099a00d2b2ed7a2cba1660bd75eaca9cc2f87
- TLSH T17E31F30005A4E2EB48C1C572F4586DBE33939D9778972C1E8232B2CDE9C589BF349DB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 8905070d138f138ab89965bfc1132a6c8c5c6a350c6d2b064735e99aef1a6337
- MD5 66d064a4ef0bb0d37454920187c17a58
- SHA1 681e86bdc76b4c8e306dfd4191e848cf7a27ea02
- SHA512 8f3f4cf1c16c7d3a14d5f6063cbf3a757f5a25767e81e3e6ea3b31da558f3615938f971c19d2bd26c748852cefcf91a0cffe43ffb7a18ab135cdfd3a40c84060
- TLSH T1B541F61005A4A2E748C08572F4582DBE37539DD779872C1E8231F6DDE8C589BF349EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 2KB
- SHA256 11ca6c67143c7451e6cd15e6f86037a2bdbd37796cc178b507fcad2cdd2bb229
- MD5 65734e40b9b35dcf54498f9cf816e5a9
- SHA1 50ca82ba1f62e11cf42b46671c4aeb54558d8b0d
- SHA512 dc8a61645081ad534d9be9d4776fb64ef8da67d3d37e6da47939ff301ed4d9f996f30de1d03fd926dbe0d302e596adaed4ee01ad26ba7e04813458238837e45c
- TLSH T18B41E31005A4A2EB48C1C572F4586DBE33539D9778972C1E8232B2CDE9C589BF349EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 2KB
- SHA256 f6f0d850e05c45f1e93cd4231ded08fc0a72a342a4c5bab2abed1aebb97f9647
- MD5 46e4a3dcf6a000de0a5eb89b8ead8c2c
- SHA1 c4875a0ce1c0e6057aab3fffeaeed59e5907b3f7
- SHA512 23c38653cc8e2012c683bd36ea30e8d2e015741e224655407ce366c6a0dcecbf6f0abb302362992eee97849fb1087c12e7d13b99eaf057c95d534b71ac130fa3
- TLSH T19951061005A4A2E748C08572F4586DBE37539DD779872C1E8232F6CDE8C589BF348EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 666B
- SHA256 6ea6bf6ae3bcecd0fb78966fea8b9bd77c0cab922399b30c210df996a96eb991
- MD5 49376929882db7916ef6a9ed0d15ab1d
- SHA1 3ce23a9b5a2c1df42856dd6f4a9033f831c4cf70
- SHA512 acaa2a31c78974adc2a95255665f3c019b718b066901d45ea0a17bb94f87773106377bfcf277f50a76a2c18ee40877a5bb468441fa683bc5415652915d0801b3
- TLSH T16A01F61005A4A2E748C08572F4182DBE33539DD77997281E8231F6CDE8C589BF349EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 255B
- SHA256 62b279564d895ecbe88d5b3c238090a1e7d2d2abc3c1cf1f835139c902c84b72
- MD5 ae63d7f804d2be16c77f56fb3babbd13
- SHA1 4d54a3874e253a88ca0a0d29934cd92444808bf6
- SHA512 61799b68faec9c291ed83469ba97ada69ac00984809ddca39255f7cd9d8e6d848ad87b5742b36b2e273b49057810b971c1fd7c92486565b3694eabc491463afd
- TLSH T1CAD06C000488E6C94DC1C631F8688E3E33A09E57A8132D12423232CCE9C11A3F30ECF8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 9931f375f591644707efe5125aa0586ee313b649563d7a0816c99950b1c797a9
- MD5 38d5c795739814000cba375e327d1f71
- SHA1 62eb8099e1198206bf92b8a6064fa55126e48626
- SHA512 004b2201b99be9ce87845b2ef7b70aca9606ce4095fcd33431429117e084e6cc5342ca329a05ea8044684afd24bd921890e946af5369d7502b7c01948a0ad9c5
- TLSH T18811E40005A4E2EB48C1C572F4585DBE33939D9B78532C1E8232B2CDE9C589BF349DB8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\svc_a25aa79f.log
- Size 1KB
- SHA256 2e6330e24209e268f00ac87a75a25abe0bab1431248bb4d327692e03bb1ffa36
- MD5 0436919d7d666448dd715e6d7140d42c
- SHA1 c599562baa4edf47934e167220dbe120d7cee27e
- SHA512 f28e3cf4f6fda69c8a26f35dead3ae301bad4d88e59b54fe9224627fcd530f241e8ec7052d6301b0a5119c857ae3fec695edd263609067efc9dbaebffafea2d7
- TLSH T1CF21F61005A4A2E748C08572F4582DBE33539DD779972C1E8231F6CDE8C589BF349EB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5nt25q5f.v5g.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH