Overview

overview

8

Static

static

3

2026-07-10...m_.exe

windows10-2004-x64

8

2026-07-10...m_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_89ff9975c75906b78ae54a089137e5bd_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
  • Size 4.2MB
  • Sample260710-mcn8faav2y
  • SHA256 207ef57fb4fa63ec5b671f51be75a0e26765e8b719e4dcac92b4a5c97e0e135c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionransomware

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Using powershell.exe command.

    execution
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_89ff9975c75906b78ae54a089137e5bd_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_89ff9975c75906b78ae54a089137e5bd_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DD567FEEAF9E289278FE753985BC12BE
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1744
    • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
      "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID fcc42c09-8938-4a35-a168-935c72b40537 -askForName=0
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5556
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4364
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EEB307267DCACC9BC8B9BF2661F868BB E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4644
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5244
  • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
    "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:248
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1144
  • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
    "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:936
  • C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
    "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Windows\SysWOW64\REG.exe
      REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3940
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2208
    • C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
      "C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1584
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3544
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2104
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2156
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5744
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4928
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:3668
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4352
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4216
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:1908
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4860
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:4940
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:6108
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:5884
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:4720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e592ef9.rbs
        • Path C:\Config.Msi\e592ef9.rbs
        • Size 219KB
        • SHA256 81ef154491bbf69eea2a83fca9a19b5f32f4469a9dbe58d35f88a6353697d316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fd_agent.dll
        • Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fd_agent.dll
        • Size 1.8MB
        • SHA256 a075919c65120a8a92d3a11895ea456ccbee501717ddb17b29578c029f0c0051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fleetdeck_agent.exe
        • Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent.exe
        • Size 6.3MB
        • SHA256 7ae8daaa4639ea38723ea77b67ce22e5312e8ac7dd20c016c41b2a88432ba989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fleetdeck_agent_svc.exe
        • Path C:\Program Files (x86)\FleetDeck Agent\20260223003825\fleetdeck_agent_svc.exe
        • Size 6.0MB
        • SHA256 d07d47dbfe061158592097c738528a808eddb1d05d02459b4fb5d01cde4a735d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        deployment.json
        • Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
        • Size 69B
        • SHA256 6f79042140a262c18356a84aa3aff2b63e401e7d1d0ab2d0ac43c183ea3edf7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fleetdeck_agent_svc.exe
        • Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
        • Size 6.0MB
        • SHA256 f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        latest.json
        • Path C:\Program Files (x86)\FleetDeck Agent\latest.json
        • Size 102B
        • SHA256 564623c3fd47db24a7cdc9e4e31cdeb7ff0d42d2de527fcd1f2dc7b4b3ab017c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        1028253661.msi
        • Path C:\Users\Admin\AppData\Local\Temp\1028253661.msi
        • Size 2.3MB
        • SHA256 0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3252.tmp
        • Path C:\Windows\Installer\MSI3252.tmp
        • Size 211KB
        • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_vzcch3tg.qu4.ps1
        • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_vzcch3tg.qu4.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FleetDeck Agent Service.log
        • Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
        • Size 947B
        • SHA256 fb159a7ca69febabd19bffaadc9a4f3663e9e01daff23e45e45bf62fec1f79cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        FleetDeck Agent Service.log
        • Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
        • Size 1KB
        • SHA256 fa14060d23cf5d8b784531582528e823c7ff2979ca991063a0c8bfd7960fc8ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2a8bfe1f2bde752a327d03f25aa8b3b2180d8eee21aa01f0ec507a9a4fda2539
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 46a7b62f63a994730315f67564f547977c1e8c4dcdab3db51d4099c4742e74fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 5a4e93292db2fa1beda21deaa5d5ea7ae02199a33e477f762784a0eab115cb6c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4ebe313755345ae016438d1a48913be2ee88625114addae068f2100340940f3a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e013c6c248541b9b8d1c89dadf0c97f1230b38d9e6ee4beba01805fa2cd57859
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 72d8029c65bfcdc77a7dbcb8bc57503bc4b22fae9ad4398f240ddfc30aebf208
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 0278912de71379baadf94add7c5b30a99498ad66f9ef8b0a097c9ed221245ee5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d2285799d703f0d8cc3a9373e3db8bee68c2fa2dffd2b76381beb4f3b52325e3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 0021279ff21f1550ee4ab1f9791986679a7a47e47decb29502596f4af6cb91e3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 e4662215852a7b931c6f7565351af127c144b19d9fecbf9399bc695107fc877b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 8bd3a0d72d9c8bfc1884c8092a23233f261249c30377de079b502de083c5880d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c8e13aa13485da106e4ff7634e75679052a1f807ec161f40039235edde3d549b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 97709cba3276e73191e9ef6185d342469828195a31250b110caa5e00d08d4637
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d4d2592314329039add617ed2e6effa5b3292602674432b700fb198ae2be7d57
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1908-125-0x000001F5D5DA0000-0x000001F5D5F62000-memory.dmp
        Download

        memory/1908-126-0x000001F5D64A0000-0x000001F5D69C8000-memory.dmp
        Download

        memory/4364-27-0x0000027821660000-0x000002782167A000-memory.dmp
        Download

        memory/4364-26-0x0000027821600000-0x000002782160E000-memory.dmp
        Download

        memory/4364-25-0x0000027821620000-0x000002782163E000-memory.dmp
        Download

        memory/4364-24-0x00000278215F0000-0x00000278215FA000-memory.dmp
        Download

        memory/4364-23-0x00000278218B0000-0x0000027821962000-memory.dmp
        Download

        memory/4364-22-0x00000278215D0000-0x00000278215EE000-memory.dmp
        Download

        memory/4364-19-0x0000027808FA0000-0x0000027808FC2000-memory.dmp
        Download