821660494a7f1d04e666cf36e8c0e82ff09efaed2e3ab140487b0df89db6a219

Analysis

max time kernel
166s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
Size 22.7MB
Sample260813-dpfmdsgd99
SHA256 821660494a7f1d04e666cf36e8c0e82ff09efaed2e3ab140487b0df89db6a219
MD5 dbd5f8ec16caa98c5096f6227780af8e
SHA1 e07c140afa3d93021d67a206971dd51e5bf04f1d
SHA512 99f50cb07cffff454e3816ccd36f7537fafda53602d7f91e7008ad21ef8910ebd97cb9ffe7bd882ea4e02fe4bd26c7cb950d0121daa8b08aa23013522d0807f7
SSDEEP 393216:6dSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/y:RvnuuAy
TLSH
T157379E03F2D799E6F4F71A3094F9A32B95367E056F2188DB82842F3A5D332D01972796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Detects executables packed with Themida 6 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5c7-71.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2656-86-0x0000000005270000-0x0000000005E30000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2656-87-0x0000000005270000-0x0000000005E30000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2656-88-0x0000000005270000-0x0000000005E30000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2656-97-0x0000000005270000-0x0000000005E30000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2656-101-0x0000000005270000-0x0000000005E30000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GTXBot.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
840	powershell.exe
3416	powershell.exe
840	powershell.exe
3416	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GTXBot.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000c00000001c5c7-71.dat	themida
behavioral2/memory/2656-86-0x0000000005270000-0x0000000005E30000-memory.dmp	themida
behavioral2/memory/2656-87-0x0000000005270000-0x0000000005E30000-memory.dmp	themida
behavioral2/memory/2656-88-0x0000000005270000-0x0000000005E30000-memory.dmp	themida
behavioral2/memory/2656-97-0x0000000005270000-0x0000000005E30000-memory.dmp	themida
behavioral2/memory/2656-101-0x0000000005270000-0x0000000005E30000-memory.dmp	themida

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
708	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2656	GTXBot.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	GTXBot.exe
2656	GTXBot.exe

Loads dropped DLL 5 IoCs

pid	Process
3432	2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
1524	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GTXBot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTXBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robocopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTXBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GTXBot.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	GTXBot.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3432	2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
3432	2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
840	powershell.exe
1524	GTXBot.exe
1524	GTXBot.exe
840	powershell.exe
840	powershell.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
1524	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
3416	powershell.exe
3416	powershell.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
3416	powershell.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe
2656	GTXBot.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2656	GTXBot.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	powershell.exe
Token: SeIncreaseQuotaPrivilege	840	powershell.exe
Token: SeSecurityPrivilege	840	powershell.exe
Token: SeTakeOwnershipPrivilege	840	powershell.exe
Token: SeLoadDriverPrivilege	840	powershell.exe
Token: SeSystemProfilePrivilege	840	powershell.exe
Token: SeSystemtimePrivilege	840	powershell.exe
Token: SeProfSingleProcessPrivilege	840	powershell.exe
Token: SeIncBasePriorityPrivilege	840	powershell.exe
Token: SeCreatePagefilePrivilege	840	powershell.exe
Token: SeBackupPrivilege	840	powershell.exe
Token: SeRestorePrivilege	840	powershell.exe
Token: SeShutdownPrivilege	840	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeSystemEnvironmentPrivilege	840	powershell.exe
Token: SeRemoteShutdownPrivilege	840	powershell.exe
Token: SeUndockPrivilege	840	powershell.exe
Token: SeManageVolumePrivilege	840	powershell.exe
Token: 33	840	powershell.exe
Token: 34	840	powershell.exe
Token: 35	840	powershell.exe
Token: 36	840	powershell.exe
Token: SeDebugPrivilege	708	tasklist.exe
Token: SeBackupPrivilege	5184	Robocopy.exe
Token: SeRestorePrivilege	5184	Robocopy.exe
Token: SeSecurityPrivilege	5184	Robocopy.exe
Token: SeTakeOwnershipPrivilege	5184	Robocopy.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	powershell.exe
Token: SeSecurityPrivilege	3416	powershell.exe
Token: SeTakeOwnershipPrivilege	3416	powershell.exe
Token: SeLoadDriverPrivilege	3416	powershell.exe
Token: SeSystemProfilePrivilege	3416	powershell.exe
Token: SeSystemtimePrivilege	3416	powershell.exe
Token: SeProfSingleProcessPrivilege	3416	powershell.exe
Token: SeIncBasePriorityPrivilege	3416	powershell.exe
Token: SeCreatePagefilePrivilege	3416	powershell.exe
Token: SeBackupPrivilege	3416	powershell.exe
Token: SeRestorePrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeSystemEnvironmentPrivilege	3416	powershell.exe
Token: SeRemoteShutdownPrivilege	3416	powershell.exe
Token: SeUndockPrivilege	3416	powershell.exe
Token: SeManageVolumePrivilege	3416	powershell.exe
Token: 33	3416	powershell.exe
Token: 34	3416	powershell.exe
Token: 35	3416	powershell.exe
Token: 36	3416	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1524	3432	2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe	89
PID 1524 wrote to memory of 840	1524	GTXBot.exe	90
PID 1524 wrote to memory of 4176	1524	GTXBot.exe	93
PID 4176 wrote to memory of 708	4176	cmd.exe	96
PID 4176 wrote to memory of 4032	4176	cmd.exe	97
PID 4176 wrote to memory of 2984	4176	cmd.exe	99
PID 4176 wrote to memory of 5184	4176	cmd.exe	100
PID 4176 wrote to memory of 2656	4176	cmd.exe	101
PID 2656 wrote to memory of 3416	2656	GTXBot.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2984	attrib.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5156

C:\Users\Admin\AppData\Local\Temp\2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_dbd5f8ec16caa98c5096f6227780af8e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\GTXBot\GTXBot.exe
  "C:\Users\Admin\GTXBot\GTXBot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\GTXBot' -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c "C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\apply_update.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "PID eq 1524"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:708
  - - C:\Windows\SysWOW64\find.exe
      find "1524"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R "C:\Users\Admin\GTXBot\*" /S /D
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2984
  - - C:\Windows\SysWOW64\Robocopy.exe
      robocopy "C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\files" "C:\Users\Admin\GTXBot" /E /COPY:DAT /R:20 /W:1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
  - - C:\Users\Admin\GTXBot\GTXBot.exe
      "C:\Users\Admin\GTXBot\GTXBot.exe" --gtxbot-updated
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\GTXBot' -ErrorAction Stop; exit 0 } catch { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sk4d.dll

Path C:\Users\Admin\AppData\Local\GTXSkia\x86\sk4d.dll
Size 19.2MB
SHA256 13a421914018f50a700914bf3581ec954ddfb903d85a441d71eace389791043c
MD5 45c0ced82866fba35ca12e350a345e75
SHA1 24eeb964e87fbf70b743cf6ad62d029eeeb106fd
SHA512 c95ed9fddd1ddaebb864023d6d906a9efcf29ce21f7f1346a488c1f96b3b4e530ba81e8d68b95dabe592b277043cafcff90a29b6a8bb95c81de5f08616a8e0d4
SSDEEP 393216:LSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/:evnuuA
TLSH
T169178D43F2E788E6E9F75A30A5F9623B95227E095F3184DB82842F375C332E015717A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 b56ced005d05e1a84704a6dc7415a77a96009496896397dee4cb0b33c691dcf2
MD5 c86fa61295e71b3a94a444acc1a52f04
SHA1 4ff7218f10db40786883c4d983b14c93ae51ee4f
SHA512 5bac6de420f6ec8073eb2f1dc982a13b14cd27f9866070ffd6f61bacdd0c6153caa190b9e0abe5a34a4d3395a8bb5c6b23c0ebfc6563da053c159eb8dce95147
SSDEEP 384:x1eBaoT1iBA+y4baOHix/+geC7r2PnBIAb34KEktWcft64DGobhNiPHlOh9fqd9:rexZ6A+rmOy/+c6ZIAb3FEkTF5bhNiP9
TLSH
T18992C678112F6DC7D8D122B014D60AA7FBB4E488DAF651D4BF1FDE2F1C90AB64EA0524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apply_update.cmd

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\apply_update.cmd
Size 1KB
SHA256 b830b692c4cea9d2472d3da8c668b97d9c5ae3a3c7af317a23f7364bb462668e
MD5 a467062957cf28fd18d5bdd2fb774368
SHA1 34e82715ad2844a7e2907e8018d24c0285903735
SHA512 48f9521612723012fcb6d5c5908ee0c5127e8633f38baa3489e3199fb06db315f28d0934f41dd1227725af87f5992527c1925b62639ee273011ecb3e14b010a8
TLSH
T13431E00D794446664FF863658B6D604DA62FA4CF4B0EF7C46933E03F724844B6AED1C2
MD5 SHA1 SHA512 TLSH

Submit Download

apply_update.log

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\apply_update.log
Size 187B
SHA256 3194c95820ccbed9fdd3675d9b48449124562620fc3b571f5a2230f88493c2c5
MD5 5ac1647f99895fc290190ed505b0e10c
SHA1 bd872c3492b0cb3e8c9fb0e9f7c00ae0078d76bc
SHA512 ba444ad47a1f76f503288eee413d78d604ebd2bc55ac17c1ab867cecb583e126480e43938c69c4237630790a6ca7d4155f41823cb4fd2d884002cb67fdc6154b
TLSH
T1CAC0126094CBD61705D57027862A7478953808CC77163170C6148496068580DFDC92D6
MD5 SHA1 SHA512 TLSH

Submit Download

gtx.dll

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\files\gtx.dll
Size 11.5MB
SHA256 9fa279a3beb86225afd5edd256f7cc278f0e9cd58b0413fbe6066ea6bf3926ab
MD5 6989f4152dd0a43d9d5faecd231c34a4
SHA1 ca3eac3144da858eba0de8d7ffab8d514867856e
SHA512 80fedac8bb55d4d87cba8c7f7fc5cd7fe726310f764234c44d9d32d0377c625f68daf6acfca697a52feb0cacca4378a846df9511b882b01ca1f22454b3cb4373
SSDEEP 98304:wZjyHyhx1toQSm4Axa5s0feCU2OSR6CU4ukyFm//I2U4X1oXSOG/QiJjxdC2rVnl:SHDPMJtLOS0CVyFQK2rVvW19sQZMyjg
TLSH
T130C6C063B649E17FD05F1A3D483BDB01D83D73B116114D27AEF8286C8F72E50199AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ryehkoyl.qma.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ryehkoyl.qma.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GTXBot.exe

Path C:\Users\Admin\GTXBot\GTXBot.exe
Size 22.7MB
SHA256 821660494a7f1d04e666cf36e8c0e82ff09efaed2e3ab140487b0df89db6a219
MD5 dbd5f8ec16caa98c5096f6227780af8e
SHA1 e07c140afa3d93021d67a206971dd51e5bf04f1d
SHA512 99f50cb07cffff454e3816ccd36f7537fafda53602d7f91e7008ad21ef8910ebd97cb9ffe7bd882ea4e02fe4bd26c7cb950d0121daa8b08aa23013522d0807f7
SSDEEP 393216:6dSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/y:RvnuuAy
TLSH
T157379E03F2D799E6F4F71A3094F9A32B95367E056F2188DB82842F3A5D332D01972796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-34-0x000000006DD90000-0x000000006DDDC000-memory.dmp

Download

memory/840-40-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/840-21-0x00000000064F0000-0x000000000684B000-memory.dmp

Download

memory/840-31-0x0000000006910000-0x000000000692E000-memory.dmp

Download

memory/840-32-0x0000000006960000-0x00000000069AC000-memory.dmp

Download

memory/840-42-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Download

memory/840-41-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

Download

memory/840-10-0x0000000005CD0000-0x000000000631A000-memory.dmp

Download

memory/840-39-0x00000000082E0000-0x000000000895C000-memory.dmp

Download

memory/840-38-0x0000000007BB0000-0x0000000007C53000-memory.dmp

Download

memory/840-37-0x00000000078F0000-0x0000000007910000-memory.dmp

Download

memory/840-15-0x0000000006390000-0x00000000063F6000-memory.dmp

Download

memory/840-33-0x00000000078B0000-0x00000000078E6000-memory.dmp

Download

memory/840-9-0x00000000033F0000-0x0000000003426000-memory.dmp

Download

memory/840-14-0x0000000005C10000-0x0000000005C32000-memory.dmp

Download

memory/840-16-0x0000000006400000-0x0000000006466000-memory.dmp

Download

memory/1524-61-0x0000000000C20000-0x00000000022EA000-memory.dmp

Download

memory/1524-51-0x0000000000C20000-0x00000000022EA000-memory.dmp

Download

memory/2656-101-0x0000000005270000-0x0000000005E30000-memory.dmp

Download

memory/2656-96-0x0000000000020000-0x00000000016EA000-memory.dmp

Download

memory/2656-86-0x0000000005270000-0x0000000005E30000-memory.dmp

Download

memory/2656-87-0x0000000005270000-0x0000000005E30000-memory.dmp

Download

memory/2656-88-0x0000000005270000-0x0000000005E30000-memory.dmp

Download

memory/2656-97-0x0000000005270000-0x0000000005E30000-memory.dmp

Download

memory/3416-94-0x0000000007540000-0x00000000075E3000-memory.dmp

Download

memory/3416-91-0x000000006E5B0000-0x000000006E5FC000-memory.dmp

Download

memory/3416-90-0x0000000006360000-0x00000000063AC000-memory.dmp

Download

memory/3416-83-0x0000000005D80000-0x00000000060DB000-memory.dmp

Download

memory/3432-4-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/3432-8-0x0000000000BE0000-0x00000000022AA000-memory.dmp

Download