Overview

overview

9

Static

static

3

2026-04-23...ar.exe

windows10-2004-x64

9

2026-04-23...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/04/2026, 10:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe
  • Size 450KB
  • Sample260423-mtk74sat2v
  • SHA256 e877da77e4523c8da3770be4f4b8ec81663e8ebfd3a19968d8691df9e4cfa07b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Custom signature
    Detects executables built or packed with MPress PE compressor 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_7f7996b9ebe1049fc36c4fea0dd6efab_cobalt-strike_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:680
      • \??\c:\updt\up.exe
        c:\updt\up.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\system32\rundll32.exe
          rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write("\74script language=jscript.encode>"+(new%20ActiveXObject("WScript.Shell")).RegRead("HKCU\\software\\microsoft\\windows\\currentversion\\run\\")+"\74/script>")
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5156
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3952
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5380
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3312
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2360
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5584
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3244
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5628
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5944
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3808
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:936
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4800
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5540
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5612
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5984
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4440
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2056
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1536
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5908
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3812
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5536
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1912
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1916
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3692
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2248
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5624
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1612
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:692
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4132
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2876
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4628
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4380
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:988
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:440
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2788
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:800
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5860
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3340
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4864
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4580
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:732
          • C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe
            "C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" iex $env:a
            5⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 1KB
        • SHA256 10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 6dc3192e511e3ed07b6d95678a0ec784cb3587fbc55aadd88eb48d448ffa3cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 048f4a49dbc5becf7b6af5f9041d31cb90104f1e3208945e5f098b34c99e6a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 86c86b0da3068f9c109082dce60ef0227a0c616e320f39f378f7af6764e87127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c1910b22006d3995cc913295b26643d04b74c2739e37b5f538df43aa96bb3611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 d816a461fe9a0c9cc40189599be4b613ea9842eb1fe9814ce92e2e653b238ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 79087723362c71aa02bcb47442396e619c4d4eb721f8eddab2582a004a0e4920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 65527af9fb74e7815ff69d21767f417e222eecf3f732a583ba3b76687f1b4f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3c51a00d5ce71b9943858fac715b2ba5bc0f8664425e05601b6d8cb78b99a0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e50631e67f77cd127de25fb0da63d32083194b81fae11091a077b0a969f0fb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 22a57765b09b01f168b10dcec9110e387d44aa5ea5d77016ac173b574ea4b03d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 246586fbba1197c392f111b2852e9ab0e4fcd4696ab5b1ea996ef32f452abb24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 2f6278095b5a62f23b59b449018e41b5cc8e4c3b569b243bc40f7290684963f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 8335d5c62aafb996f77ae4bd1574288f1889b4fdebe1cb5ecb4324b301f5fc3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 081851664ceb6bb22bd1dce9f9179e8da0951aa197c868c3bf5a441c116c612c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 b58290fe838bbbaef8c05cde8804fc8b32d3c672bca5778b7b38186a144b32d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 ff137e57d4d79f261bcc07401eab6df1d9bb12dd59631a2171dd2920d02f8ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 840d50d5a9f99421a39502245e8167dc5e875ea86960ce8d37c0c9b0cc833af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3bcad68f0a7f7dce062489dc736ad2e53083c71d57606dacaaf7712c69c451be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 295c6310f7507989a051cc353a9dcdacfced1a45f62399f8e958f3fbbe889841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 fa980b1e8a8e27d7953707de9e63e9a4c33371c18f2621a7f9fec142ea1c5795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 57c36baffdcfbecaf8503d1541804206604f7582a5ed5554c61af6df8e11dabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c2cabc95a784937ef06e87f4112b9fe9f5721ca37742c5f0bf03fff9a999b37e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 5345f089e9485ea87b0d2a770f32ec97c0af77d2af2dfc5c416c2828143dc0ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e0eb7894dea72bd0effb10cada11f54ddcfcf1e6b619319e6f4c0db898e284d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 9b2cd956daa5e485ae412a4f3c5139470ee3bd726add8dccb166ec49b60e192b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 a8d18e6694f1f5fb4927d7ef68f593eed15640e84bf396ea8a957c9095c8b7c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 0437df6e4275ab1e7749c5beb92605eb8d40e9bff5bf5d7f90011225e3d73638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 5367d9ceeabe81730d1645c2db5f650d613abaefdf9d4bddb4d8888fb89aade0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 6552051eeecb9d2bee4499f3222411ce543d21cd2a769897bb463218b7e923ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e6a98a2575de4e5a6e34b85978d31ea47189bb3055aa837664ae1a3f108e2df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 5e3b5d5513934701322006578345271da6170da23bb30ac64a1685f10bcdb8d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 550a1ed38bfbd6a9b4c2f9456bc47e37266d030c7eb3766c9a15c892ce1d4373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 067aeff9ed665a08840308f15e21d6259fafb9de11c2f07dfdd7ff5823188ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 dd7770e726aa873accf235346cdfdef619c68f576ccf212c53836f7716a82e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e0dd9bfc5d00759c01bc4455aa4a0234f9bdb37e2ce4700c766100386c15adab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3ba7e234d769f6aec6aecfe6396a34b4c902dcbac1b60a2c0045178733a43571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 83ddbfb8e18177843f2cb0fd5b12069da7c1a7277ef4b15762e12dce0ea335a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e4c5cbf6e263e28ab15bceb2c95960a484160aad6709b45134106f1590f920f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 ff5870766c1bf03b247c38e1753713d12ab56986515dc6d4118bf97874409137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 3bf0b269bc268a4762c639ea504bc7b1ee2d219849e5b5bd479e8f262c3ec497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 e7af85d6e43ee08e2fc330d8df56f381067b5bc3aadb9c52a9aa1945371054e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 a69b4e78e9342c8989da1791db6d369daceb2871bf6ffc3a44170381351fb089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 c57101d1640dee7633a0ab7f4c16c9e10531e2617627116727289c1a3548d04e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\2.dll
        • Size 89KB
        • SHA256 5c09984db55f3622f14f447045df7ebfe7bca3ffe445a9dbbdb16e4fee7e89a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_gtg3r4l5.inw.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtg3r4l5.inw.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        up.exe
        • Path C:\updt\up.exe
        • Size 70KB
        • SHA256 4b0c5e7fa163edb3cf2e3c073c4b597ee98c287ef5d398f0f8318e06f681e19a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2360-66-0x0000000005860000-0x0000000005BB7000-memory.dmp
        Download

        memory/2648-19-0x0000000005EA0000-0x0000000005F06000-memory.dmp
        Download

        memory/2648-25-0x0000000005FD0000-0x0000000006327000-memory.dmp
        Download

        memory/2648-15-0x00000000050B0000-0x00000000050E6000-memory.dmp
        Download

        memory/2648-18-0x0000000005E30000-0x0000000005E96000-memory.dmp
        Download

        memory/2648-27-0x00000000064E0000-0x00000000064FE000-memory.dmp
        Download

        memory/2648-28-0x0000000006570000-0x00000000065BC000-memory.dmp
        Download

        memory/2648-29-0x0000000007D40000-0x00000000083BA000-memory.dmp
        Download

        memory/2648-30-0x0000000006A00000-0x0000000006A1A000-memory.dmp
        Download

        memory/2648-17-0x0000000005D90000-0x0000000005DB2000-memory.dmp
        Download

        memory/2648-16-0x0000000005760000-0x0000000005D8A000-memory.dmp
        Download

        memory/3692-240-0x0000000005B20000-0x0000000005E77000-memory.dmp
        Download

        memory/3808-116-0x0000000005B80000-0x0000000005ED7000-memory.dmp
        Download

        memory/3812-207-0x0000000005850000-0x0000000005BA7000-memory.dmp
        Download

        memory/3952-34-0x0000000006320000-0x0000000006677000-memory.dmp
        Download

        memory/4892-6-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4892-8-0x0000000000406000-0x0000000000407000-memory.dmp
        Download

        memory/4892-9-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4892-10-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4892-11-0x0000000000406000-0x0000000000407000-memory.dmp
        Download

        memory/4892-76-0x0000000000400000-0x0000000000415000-memory.dmp
        Download

        memory/4952-84-0x00000000056D0000-0x0000000005A27000-memory.dmp
        Download

        memory/5380-49-0x00000000065C0000-0x0000000006917000-memory.dmp
        Download