salatstealer | 3cbb92385ec70adc79f268f093ffe54427d6d12f3e2212a9c515156cd126fa35

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive.exe
Size 9.8MB
Sample261011-rseq6abc26
SHA256 3cbb92385ec70adc79f268f093ffe54427d6d12f3e2212a9c515156cd126fa35
MD5 4f10dba0fa9ad82b6a531947fa69dd8b
SHA1 e52a4740a32353944335007b775df339bf1d3997
SHA512 4895b11c3c78c10a5eaac44f780f8d29287fae0af81b933de917dbc33d5f5da1c6e1a6e439b8634a1c836548cf5bec698ae070f9e9926ddfcfe1a7fc04fbfc12
SSDEEP 196608:hZjGf94d+w4YkRKXLO3s35ynQdvoIALP21Z+Ko9ezMt7Vd1ndNsiid7V:njG9waoD5lvofLP218KyrtZvdNsB
TLSH
T11AA633D2B5E01FC79C3394B211DB5014A13D467D0A99C826D26D776B39AEFCBE8309B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution salatstealer persistence stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024451-3.dat	family_salatstealer

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 8 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024451-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2148-15-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2496-14-0x00007FF660130000-0x00007FF662A88000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2376-58-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2376-63-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2376-65-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2376-68-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2376-70-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/1196-0-0x00007FF710740000-0x00007FF7132A5000-memory.dmp	UPX
behavioral1/memory/1196-6-0x00007FF710740000-0x00007FF7132A5000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
2496	MoUsoCoreWorker.exe
2148	MoUsoCoreWorker.exe
2376	MoUsoCoreWorker.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
1084	powershell.exe

Discovers running processes 1 TTPs 22 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4348	tasklist.exe
2488	tasklist.exe
2392	tasklist.exe
2664	tasklist.exe
4760	tasklist.exe
5012	tasklist.exe
3752	tasklist.exe
4700	tasklist.exe
4356	tasklist.exe
5084	tasklist.exe
3764	tasklist.exe
2652	tasklist.exe
5068	tasklist.exe
3720	tasklist.exe
208	tasklist.exe
3784	tasklist.exe
1428	tasklist.exe
2516	tasklist.exe
3148	tasklist.exe
648	tasklist.exe
4660	tasklist.exe
3144	tasklist.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1196-0-0x00007FF710740000-0x00007FF7132A5000-memory.dmp	upx
behavioral1/memory/1196-6-0x00007FF710740000-0x00007FF7132A5000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4608	powershell.exe
2668	powershell.exe
2016	powershell.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PHYSICALDRIVE0	MoUsoCoreWorker.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MoUsoCoreWorker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2668	powershell.exe
2668	powershell.exe
1084	powershell.exe
1084	powershell.exe
2016	powershell.exe
2016	powershell.exe
4608	powershell.exe
4608	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	5012	tasklist.exe
Token: SeDebugPrivilege	4348	tasklist.exe
Token: SeDebugPrivilege	2652	tasklist.exe
Token: SeDebugPrivilege	3752	tasklist.exe
Token: SeDebugPrivilege	2516	tasklist.exe
Token: SeDebugPrivilege	5068	tasklist.exe
Token: SeDebugPrivilege	3720	tasklist.exe
Token: SeDebugPrivilege	208	tasklist.exe
Token: SeDebugPrivilege	3784	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe
Token: SeDebugPrivilege	3148	tasklist.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	2392	tasklist.exe
Token: SeDebugPrivilege	2664	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	648	tasklist.exe
Token: SeDebugPrivilege	1428	tasklist.exe
Token: SeDebugPrivilege	3764	tasklist.exe
Token: SeDebugPrivilege	4660	tasklist.exe
Token: SeDebugPrivilege	3144	tasklist.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2496	1196	2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive.exe	89
PID 2496 wrote to memory of 4760	2496	MoUsoCoreWorker.exe	91
PID 2496 wrote to memory of 5012	2496	MoUsoCoreWorker.exe	93
PID 2496 wrote to memory of 4348	2496	MoUsoCoreWorker.exe	94
PID 2496 wrote to memory of 2652	2496	MoUsoCoreWorker.exe	95
PID 2496 wrote to memory of 3752	2496	MoUsoCoreWorker.exe	96
PID 2496 wrote to memory of 2516	2496	MoUsoCoreWorker.exe	97
PID 2496 wrote to memory of 5068	2496	MoUsoCoreWorker.exe	127
PID 2496 wrote to memory of 3720	2496	MoUsoCoreWorker.exe	101
PID 2496 wrote to memory of 208	2496	MoUsoCoreWorker.exe	102
PID 2496 wrote to memory of 3784	2496	MoUsoCoreWorker.exe	103
PID 2496 wrote to memory of 4700	2496	MoUsoCoreWorker.exe	104
PID 2496 wrote to memory of 4464	2496	MoUsoCoreWorker.exe	106
PID 2496 wrote to memory of 2148	2496	MoUsoCoreWorker.exe	108
PID 2376 wrote to memory of 3148	2376	MoUsoCoreWorker.exe	110
PID 2376 wrote to memory of 2488	2376	MoUsoCoreWorker.exe	111
PID 2376 wrote to memory of 4356	2376	MoUsoCoreWorker.exe	112
PID 2376 wrote to memory of 2392	2376	MoUsoCoreWorker.exe	113
PID 2376 wrote to memory of 2664	2376	MoUsoCoreWorker.exe	114
PID 2376 wrote to memory of 5084	2376	MoUsoCoreWorker.exe	115
PID 2376 wrote to memory of 648	2376	MoUsoCoreWorker.exe	116
PID 2376 wrote to memory of 1428	2376	MoUsoCoreWorker.exe	117
PID 2376 wrote to memory of 3764	2376	MoUsoCoreWorker.exe	118
PID 2376 wrote to memory of 4660	2376	MoUsoCoreWorker.exe	119
PID 2376 wrote to memory of 3144	2376	MoUsoCoreWorker.exe	120
PID 2376 wrote to memory of 2668	2376	MoUsoCoreWorker.exe	121
PID 2376 wrote to memory of 1084	2376	MoUsoCoreWorker.exe	122
PID 2376 wrote to memory of 2016	2376	MoUsoCoreWorker.exe	123
PID 2376 wrote to memory of 4608	2376	MoUsoCoreWorker.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_4f10dba0fa9ad82b6a531947fa69dd8b_hive.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\MoUsoCoreWorker.exe
  C:\Users\Admin\AppData\Local\Temp\MoUsoCoreWorker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3752
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq xenservice.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq qemuga.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\MoUsoCoreWorker_task.xml /TN MoUsoCoreWorker /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe
    3⤵
    - Executes dropped EXE
    PID:2148

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MoUsoCoreWorker.exe
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3148
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmacthlp.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemu-ga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq xenservice.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq qemuga.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmsrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmusrvc.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq prl_tools.exe" /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 efe6de17c06ab84e960b58509c345bed4c553314d88ad7f0620d7b1e94b8ae91
MD5 d42703676942bf54e56f49ce1f7f6f44
SHA1 5a8f8d23510198c8568a7ffede815da46804c95b
SHA512 7ea6ba3f7d4638472768f8728c39b6e40d73e46540d4fe09c9895830ea2fd83a11bf302c7caeb2dc0eec3318145269dd31f85d053bfd83442c1c5c63b9d9fcf1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

MoUsoCoreWorker.exe

Path C:\Users\Admin\AppData\Local\Temp\MoUsoCoreWorker.exe
Size 9.0MB
SHA256 d95508f99b9bb9a92992553b5530d693f413537744f4140d2571857e889dfab1
MD5 c6cce1c235970137c35989f0c9d1bd3b
SHA1 7b64fd08b96a2105babfb8534ab01c52556ce193
SHA512 b084dded3c7df1d88ebc8bdabc52db0c32a74d672b4ef71d562d58af3bfca45f0799ce8fa2d13e932dfd37de7a32dabb1b5c0947e72a2b9a3f5c98708517842d
SSDEEP 98304:T2GAMvX17NG05XKtQqVpGn3wACOtE8VtLEL:p3f1RtKfpyf0wtLEL
TLSH
T144963913ECA615E9C0AED17189769263BB317C491B3127E71AA0F6342F32FD0ADB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoUsoCoreWorker_task.xml

Path C:\Users\Admin\AppData\Local\Temp\MoUsoCoreWorker_task.xml
Size 1KB
SHA256 5d99ab0eb44487c05b2f3a31f75c56244beacb78e20a9fd22d35fbfa21708421
MD5 4947d4a397db0b43665a4bf614c2fff4
SHA1 cdeb5c42c695e4fc6056dfcb99aa0e4552b82de8
SHA512 0c5a88245480298e7c66127477dffe1d309c33ecc3328549b2ee3680ec0baf81a27c014eeeadb5d83ff8edc8c59ed3608ca4b5f4547ab55b4fd5c2b014c189cc
TLSH
T1102112905C14F11B7556663ACB921382373E5B650AB55138D8CC4DBC748A1C6711397B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_f2fmzn1h.iqy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f2fmzn1h.iqy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-6-0x00007FF710740000-0x00007FF7132A5000-memory.dmp

Download

memory/1196-0-0x00007FF710740000-0x00007FF7132A5000-memory.dmp

Download

memory/2148-15-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2376-58-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2376-63-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2376-65-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2376-68-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2376-70-0x00007FF759C80000-0x00007FF75C5D8000-memory.dmp

Download

memory/2496-14-0x00007FF660130000-0x00007FF662A88000-memory.dmp

Download

memory/2668-18-0x000002421B230000-0x000002421B252000-memory.dmp

Download