4aaa4b4d1a037e15fce033952d3e14596cfeb3d5e73b2175d2b84352e49d354b

Analysis

max time kernel
165s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
Size 22.7MB
Sample260816-pyjaesyaje
SHA256 4aaa4b4d1a037e15fce033952d3e14596cfeb3d5e73b2175d2b84352e49d354b
MD5 ddc929153ed104c78fe9098964b1260f
SHA1 bad902af135fe7f8344fa932c048216e02f8fca2
SHA512 e82b8d60cc407a777165ed9d4b2c2205e64b05bebed5873c6a4a5b253c5635d7e4bbb481d0c0149d2242ffc0ce33aa55d4799793ef89d7ca7a4a782e362aa60d
SSDEEP 393216:0nSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/+:JvnuuA+
TLSH
T111379E03F2D799E6F4F71A3094F9A32B95367E056F2188DB82842F3A5D332D01972796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution themida trojan

Malware Config

Signatures

Detects executables packed with Themida 6 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c565-71.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4228-82-0x0000000005530000-0x00000000060F0000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4228-85-0x0000000005530000-0x00000000060F0000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4228-88-0x0000000005530000-0x00000000060F0000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4228-95-0x0000000005530000-0x00000000060F0000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/4228-102-0x0000000005530000-0x00000000060F0000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GTXBot.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
1488	powershell.exe
1128	powershell.exe
1488	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GTXBot.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000c00000001c565-71.dat	themida
behavioral2/memory/4228-82-0x0000000005530000-0x00000000060F0000-memory.dmp	themida
behavioral2/memory/4228-85-0x0000000005530000-0x00000000060F0000-memory.dmp	themida
behavioral2/memory/4228-88-0x0000000005530000-0x00000000060F0000-memory.dmp	themida
behavioral2/memory/4228-95-0x0000000005530000-0x00000000060F0000-memory.dmp	themida
behavioral2/memory/4228-102-0x0000000005530000-0x00000000060F0000-memory.dmp	themida

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3460	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4228	GTXBot.exe

Executes dropped EXE 2 IoCs

pid	Process
4864	GTXBot.exe
4228	GTXBot.exe

Loads dropped DLL 5 IoCs

pid	Process
4260	2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
4864	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GTXBot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2032	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTXBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTXBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Robocopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GTXBot.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	GTXBot.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	GTXBot.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4260	2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
4260	2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
1128	powershell.exe
1128	powershell.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4864	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
1488	powershell.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe
1488	powershell.exe
1488	powershell.exe
4228	GTXBot.exe
4228	GTXBot.exe
4228	GTXBot.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	GTXBot.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe
Token: 33	1128	powershell.exe
Token: 34	1128	powershell.exe
Token: 35	1128	powershell.exe
Token: 36	1128	powershell.exe
Token: SeDebugPrivilege	3460	tasklist.exe
Token: SeBackupPrivilege	3196	Robocopy.exe
Token: SeRestorePrivilege	3196	Robocopy.exe
Token: SeSecurityPrivilege	3196	Robocopy.exe
Token: SeTakeOwnershipPrivilege	3196	Robocopy.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeIncreaseQuotaPrivilege	1488	powershell.exe
Token: SeSecurityPrivilege	1488	powershell.exe
Token: SeTakeOwnershipPrivilege	1488	powershell.exe
Token: SeLoadDriverPrivilege	1488	powershell.exe
Token: SeSystemProfilePrivilege	1488	powershell.exe
Token: SeSystemtimePrivilege	1488	powershell.exe
Token: SeProfSingleProcessPrivilege	1488	powershell.exe
Token: SeIncBasePriorityPrivilege	1488	powershell.exe
Token: SeCreatePagefilePrivilege	1488	powershell.exe
Token: SeBackupPrivilege	1488	powershell.exe
Token: SeRestorePrivilege	1488	powershell.exe
Token: SeShutdownPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeSystemEnvironmentPrivilege	1488	powershell.exe
Token: SeRemoteShutdownPrivilege	1488	powershell.exe
Token: SeUndockPrivilege	1488	powershell.exe
Token: SeManageVolumePrivilege	1488	powershell.exe
Token: 33	1488	powershell.exe
Token: 34	1488	powershell.exe
Token: 35	1488	powershell.exe
Token: 36	1488	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4864	4260	2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe	89
PID 4864 wrote to memory of 1128	4864	GTXBot.exe	90
PID 4864 wrote to memory of 2032	4864	GTXBot.exe	94
PID 2032 wrote to memory of 3460	2032	cmd.exe	96
PID 2032 wrote to memory of 5228	2032	cmd.exe	97
PID 2032 wrote to memory of 4520	2032	cmd.exe	99
PID 2032 wrote to memory of 3196	2032	cmd.exe	100
PID 2032 wrote to memory of 4228	2032	cmd.exe	101
PID 4228 wrote to memory of 1488	4228	GTXBot.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4520	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_ddc929153ed104c78fe9098964b1260f_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_luca-.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\GTXBot\GTXBot.exe
  "C:\Users\Admin\GTXBot\GTXBot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\GTXBot' -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c "C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\apply_update.cmd"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "PID eq 4864"
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3460
  - - C:\Windows\SysWOW64\find.exe
      find "4864"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -R "C:\Users\Admin\GTXBot\*" /S /D
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4520
  - - C:\Windows\SysWOW64\Robocopy.exe
      robocopy "C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\files" "C:\Users\Admin\GTXBot" /E /COPY:DAT /R:20 /W:1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
  - - C:\Users\Admin\GTXBot\GTXBot.exe
      "C:\Users\Admin\GTXBot\GTXBot.exe" --gtxbot-updated
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\GTXBot' -ErrorAction Stop; exit 0 } catch { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sk4d.dll

Path C:\Users\Admin\AppData\Local\GTXSkia\x86\sk4d.dll
Size 19.2MB
SHA256 13a421914018f50a700914bf3581ec954ddfb903d85a441d71eace389791043c
MD5 45c0ced82866fba35ca12e350a345e75
SHA1 24eeb964e87fbf70b743cf6ad62d029eeeb106fd
SHA512 c95ed9fddd1ddaebb864023d6d906a9efcf29ce21f7f1346a488c1f96b3b4e530ba81e8d68b95dabe592b277043cafcff90a29b6a8bb95c81de5f08616a8e0d4
SSDEEP 393216:LSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/:evnuuA
TLSH
T169178D43F2E788E6E9F75A30A5F9623B95227E095F3184DB82842F375C332E015717A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 e4b1a3bfc02921093be3a2c2f1e9b8a1b36529b965958d3695564c6137ce0def
MD5 ee07d03d2572eb5344677f2131041fe8
SHA1 cdb7ea5468923f53bef9fddac7d5761f62ea757b
SHA512 6924456b85c6e353ff4d695855cc684013bb097076dbc7690870fbc82be101be4806b6e3ccbc7dffecda8122cc4b1aceec86ee2acef1764a4ba1d6512c7d7732
SSDEEP 384:o1eBaoT1iBA+y4b+4yq40r+bQCak23T1IAb34KAktWsHt64fGobhNiPXl6h9fuF9:kexZ6A+r6Xq4y+4Z5IAb3FAkLx5bhNi1
TLSH
T14992B678112F6DC7D8D126B410D50AA7FBA4E488DAF511D4BF2FDE2F1C90ABA4EA0524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apply_update.cmd

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\apply_update.cmd
Size 1KB
SHA256 1ce3068a12093929cd19b3e794fc8d56d1ce920d114fb545b62466e2f9f8e8f8
MD5 e8bd6cce039750c7c9058ed6e94f037e
SHA1 f32466d7c801949ecb0577830fef9d4e2bcc50a6
SHA512 fa236f0c078593a5c8c357831e8ecc6406ae40ae95053285a2f95274d1f7a72ecc68d87e5448c8e5df56742d509de7c64f21471025c0b127a85919edbfaca936
TLSH
T15F31E00D794442664FF863658B6D604DA62FA4CF4B0EFBD06933E03FB24844B69ED1C2
MD5 SHA1 SHA512 TLSH

Submit Download

GTXBot.exe

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\files\GTXBot.exe
Size 22.7MB
SHA256 821660494a7f1d04e666cf36e8c0e82ff09efaed2e3ab140487b0df89db6a219
MD5 dbd5f8ec16caa98c5096f6227780af8e
SHA1 e07c140afa3d93021d67a206971dd51e5bf04f1d
SHA512 99f50cb07cffff454e3816ccd36f7537fafda53602d7f91e7008ad21ef8910ebd97cb9ffe7bd882ea4e02fe4bd26c7cb950d0121daa8b08aa23013522d0807f7
SSDEEP 393216:6dSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/y:RvnuuAy
TLSH
T157379E03F2D799E6F4F71A3094F9A32B95367E056F2188DB82842F3A5D332D01972796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtx.dll

Path C:\Users\Admin\AppData\Local\Temp\GTX\LauncherUpdate\GTXBot\files\gtx.dll
Size 11.5MB
SHA256 9fa279a3beb86225afd5edd256f7cc278f0e9cd58b0413fbe6066ea6bf3926ab
MD5 6989f4152dd0a43d9d5faecd231c34a4
SHA1 ca3eac3144da858eba0de8d7ffab8d514867856e
SHA512 80fedac8bb55d4d87cba8c7f7fc5cd7fe726310f764234c44d9d32d0377c625f68daf6acfca697a52feb0cacca4378a846df9511b882b01ca1f22454b3cb4373
SSDEEP 98304:wZjyHyhx1toQSm4Axa5s0feCU2OSR6CU4ukyFm//I2U4X1oXSOG/QiJjxdC2rVnl:SHDPMJtLOS0CVyFQK2rVvW19sQZMyjg
TLSH
T130C6C063B649E17FD05F1A3D483BDB01D83D73B116114D27AEF8286C8F72E50199AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cxf4lbov.031.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxf4lbov.031.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

GTXBot.exe

Path C:\Users\Admin\GTXBot\GTXBot.exe
Size 22.7MB
SHA256 4aaa4b4d1a037e15fce033952d3e14596cfeb3d5e73b2175d2b84352e49d354b
MD5 ddc929153ed104c78fe9098964b1260f
SHA1 bad902af135fe7f8344fa932c048216e02f8fca2
SHA512 e82b8d60cc407a777165ed9d4b2c2205e64b05bebed5873c6a4a5b253c5635d7e4bbb481d0c0149d2242ffc0ce33aa55d4799793ef89d7ca7a4a782e362aa60d
SSDEEP 393216:0nSK+mbiYoRZRI+wkpHiXUxY/iJ53IWhlVjEeIZ/+:JvnuuA+
TLSH
T111379E03F2D799E6F4F71A3094F9A32B95367E056F2188DB82842F3A5D332D01972796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-30-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Download

memory/1128-13-0x00000000061E0000-0x0000000006246000-memory.dmp

Download

memory/1128-16-0x0000000006250000-0x00000000065AB000-memory.dmp

Download

memory/1128-17-0x0000000006730000-0x000000000674E000-memory.dmp

Download

memory/1128-18-0x00000000067B0000-0x00000000067FC000-memory.dmp

Download

memory/1128-22-0x0000000006D40000-0x0000000006D76000-memory.dmp

Download

memory/1128-23-0x000000006DFA0000-0x000000006DFEC000-memory.dmp

Download

memory/1128-26-0x0000000006D80000-0x0000000006DA0000-memory.dmp

Download

memory/1128-27-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/1128-28-0x0000000008110000-0x000000000878C000-memory.dmp

Download

memory/1128-29-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Download

memory/1128-12-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/1128-31-0x0000000007D40000-0x0000000007DD6000-memory.dmp

Download

memory/1128-9-0x0000000003210000-0x0000000003246000-memory.dmp

Download

memory/1128-10-0x0000000005AB0000-0x00000000060FA000-memory.dmp

Download

memory/1128-11-0x0000000005940000-0x0000000005962000-memory.dmp

Download

memory/1488-86-0x0000000006200000-0x000000000655B000-memory.dmp

Download

memory/1488-93-0x00000000078C0000-0x0000000007963000-memory.dmp

Download

memory/1488-90-0x000000006E730000-0x000000006E77C000-memory.dmp

Download

memory/1488-89-0x0000000006660000-0x00000000066AC000-memory.dmp

Download

memory/4228-88-0x0000000005530000-0x00000000060F0000-memory.dmp

Download

memory/4228-85-0x0000000005530000-0x00000000060F0000-memory.dmp

Download

memory/4228-82-0x0000000005530000-0x00000000060F0000-memory.dmp

Download

memory/4228-95-0x0000000005530000-0x00000000060F0000-memory.dmp

Download

memory/4228-94-0x00000000001A0000-0x000000000186A000-memory.dmp

Download

memory/4228-97-0x00000000001A0000-0x000000000186A000-memory.dmp

Download

memory/4228-102-0x0000000005530000-0x00000000060F0000-memory.dmp

Download

memory/4260-8-0x0000000000E40000-0x000000000250A000-memory.dmp

Download

memory/4260-4-0x0000000004810000-0x0000000004811000-memory.dmp

Download

memory/4864-67-0x0000000001000000-0x00000000026CA000-memory.dmp

Download

memory/4864-32-0x0000000001000000-0x00000000026CA000-memory.dmp

Download

memory/4864-44-0x0000000001000000-0x00000000026CA000-memory.dmp

Download