Overview

overview

7

Static

static

3

2026-10-23...lc.exe

windows10-2004-x64

7

2026-10-23...lc.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 09:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 10.8MB
  • Sample261023-lfnkmsxtdv
  • SHA256 92195e0f7e57b183dfaae1acbb9f290d0e442439bec34c8e9d20f531b5b43fbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

    Using powershell.exe command.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" --security-observer=116C,224,228,230
      2⤵
        PID:5700
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:936
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5732
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2248
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1996
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2240
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2988
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Windows\System32\Dism\dismhost.exe
          C:\Windows\System32\Dism\dismhost.exe {7971DCFF-4C45-43C2-84A7-AF0BB18702BD}
          3⤵
          • Drops file in Windows directory
          PID:4708
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3124
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3704
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5844
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3740
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2080
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3340
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4408
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4032
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3004
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3920
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5672
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3696
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1716
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5268
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4784
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3492
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2660
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:776
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1772
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4224
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3756
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5808
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3068
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2356
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2604
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1468
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1612
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3972

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 cfe7f23aea9e7003aa0021e2576460ef539ad28b7af6fc7b902ce56b35903251
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 64232b71ba9077c7cc236280f828066ed55656333fbb861c652be336cf358c73
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 0282b4dfa9607280170bee6cbb1862b74ba0e1179790d019a6b6becd71f4fce9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2ab96330a33e8821004febafe33501787710f5ba1ef86f5f82ea7c425a271d61
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 16aab2fa86ffb6867296ab520375217b7c435fc055aca660b4bf31a0f660246b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 71e5725e1db9e1f707ba65d1605052ef9332b1a2d26dccd549fdd4ba978b17fc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 616a5f0ae7f26ba24b505902798ba7993f9f5543c8f3dfb81be80ecbcaef4ec6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 0fbdecf06be079b8e316ede18859cc190dfacaae090f6d4a51ab0b723f4f8276
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 07b054e0065d21b382f45ad66ca1217985bf302ce54cc68e0dd554b8911ba701
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 6887b46a6ab7f4651bb6b4fcefca922c65b6ed3290ab4df0cdd60699e9e38183
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7f26b220105c2bbeaebef79656dae0d5463ebf860c236670341c75abf707669f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 b4f6f60db0a0b03d4564ff8681e9e69fe52cc435405ed90b21b5d28abffa77c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1dd7cbfd772352e379cbf1c95cb5eae50ec75b73b1cb746f57e3f9b76caaa92c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 94d46bf6480771ff90c7dca5f3e32270a686b65728f0cd22130ea97516bbdda1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 dc760a0cc778409b151c997fc2bfcf67c253f3e4e0e0a235298224ffdab0e5e9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 c05dfe4a7d0533e50d27c5acbf1f862d42c76f67e32dcf9192498343fec9b8dc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 e6116d76f8deb4b2da1b2a5d8959f6d6f0adb8e1b9655c6d5a22ffaea5ab4824
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 da56acf1cfdd8636b03e0563bf3687bedc9971b1f78862b7e3d3699a314fe07a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 b062903ff9432818ba03ce2d3a544eb74504d018842bce73d4aea9a49fc82e06
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7981428a04110ad164c8f0fc0e24ae147dde188b7eb8554cc757b3af63c60474
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 9b1677492ae8ffc9a5a357056e8f1cdb1b2d284bfaf1f7e560784d3267cef64b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1204e5530d956f597dac00069e5c237a4ff754a6403b6cbb335ab67259865a71
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2e932b70bddeb73cd569b132e6c4895fe9e4572a53f27478fd22d982f3dc4ed1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 04e3c0921183ab853cbe2abc9280ebb0fe35aa955b592154ae8d93565dcb169d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 18b3c30f87c93ff3ec3be6539565369c32f4b244a61570854b4b25ad048dbc72
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_c5nbilz5.l2d.psm1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c5nbilz5.l2d.psm1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dism.log
          • Path C:\Windows\Logs\DISM\dism.log
          • Size 292KB
          • SHA256 06f7a9db0a8b93c9e0214617d111df0f8c779ef1eb408c8bb957dbfb9a6501a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dism.log
          • Path C:\Windows\Logs\DISM\dism.log
          • Size 298KB
          • SHA256 23a36e82ccdb28bfaa2656c9e8376b237fd420fb645c64ada8e0c90b81f8869e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/936-8-0x000001B7F76C0000-0x000001B7F76EA000-memory.dmp
          Download

          memory/936-0-0x000001B7F7290000-0x000001B7F72B2000-memory.dmp
          Download

          memory/936-5-0x000001B7F7330000-0x000001B7F734E000-memory.dmp
          Download

          memory/936-6-0x000001B7F75A0000-0x000001B7F7652000-memory.dmp
          Download

          memory/936-7-0x000001B7F7350000-0x000001B7F735A000-memory.dmp
          Download

          memory/936-9-0x000001B7F76C0000-0x000001B7F76E4000-memory.dmp
          Download

          memory/2248-22-0x00000175FE710000-0x00000175FE72E000-memory.dmp
          Download

          memory/2248-23-0x00000175FE6F0000-0x00000175FE6FA000-memory.dmp
          Download

          memory/2248-24-0x00000175FE700000-0x00000175FE70A000-memory.dmp
          Download

          memory/2356-211-0x000001CE76180000-0x000001CE76232000-memory.dmp
          Download

          memory/2744-49-0x000001F56E590000-0x000001F56E5B8000-memory.dmp
          Download

          memory/2744-69-0x000001F56F0C0000-0x000001F56F169000-memory.dmp
          Download