Overview

overview

7

Static

static

3

2026-10-28...jr.exe

windows10-2004-x64

7

2026-10-28...jr.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 22:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
  • Size 494KB
  • Sample261029-2payxafv3s
  • SHA256 31ce462fd9d2d1e41c8ee0f4a8afa1f598072f0defb4816c115554d8f3111c1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 35 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ba9903f96285fe80f1be64f49e19eee_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe"
    1⤵
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5976
    • C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
      "microsoftedgeupdatecore32.exe "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4768
    • C:\Windows\SysWOW64\eventviewer.exe
      "C:\Windows\system32\eventviewer.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1604
        3⤵
        • Program crash
        PID:3168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 1780
      2⤵
      • Program crash
      PID:3248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2364 -ip 2364
    1⤵
      PID:1000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5976 -ip 5976
      1⤵
        PID:4644
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.1 -wce:0000000000000214 -fullsync -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc
          2⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3128
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.2 -wce:0000000000000214 -fullsync -m:devinv.dll -f:CreateDeviceInventory
          2⤵
          • Checks BIOS information in registry
          • Checks SCSI registry key(s)
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:5948
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.3 -wce:0000000000000214 -fullsync -m:aeinv.dll -f:GetApplicationKBs
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2196
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.4 -wce:0000000000000214 -fullsync -m:appraiser.dll -f:UpdateAvStatus
          2⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:2164
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.5 -wce:0000000000000214 -fullsync -m:GeneralTel.dll -f:RunGeneralTelemetry
          2⤵
          • Enumerates connected drives
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:4788
        • C:\Windows\system32\compattelrunner.exe
          C:\Windows\system32\compattelrunner.exe -cv:F8EZWF24x0qsfR7r.0.6 -wce:0000000000000210 -fullsync -m:appraiser.dll -f:DoScheduledTelemetryRun
          2⤵
          • Checks BIOS information in registry
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
            3⤵
            • Drops file in Windows directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2660
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4800
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command $Res = 0 $InboxIMEs = (@( '{0000897b-83df-4b96-be07-0fb58b01c4a4}','{03b5835f-f03c-411b-9ce2-aa23e1171e36}', '{531fdebf-9b4c-4a43-a2aa-960e8fcdc732}','{6a498709-e00b-4c45-a018-8f9e4081ae40}', '{7c472071-36a7-4709-88cc-859513e583a9}','{81d4e9c9-1d3b-41bc-9e6c-4b40bf79e35e}', '{81ea0a17-aa39-455b-ba20-ea79a8f98966}','{8613e14c-d0c0-4161-ac0f-1dd2563286bc}', '{a028ae76-01b1-46c2-99c4-acd9858ae02f}','{a1e2b86b-924a-4d43-80f6-8a820df7190f}', '{b115690a-ea02-48d5-a231-e3578d2fdf80}','{c2cb2cf0-af47-413e-9780-8bc3a3c16068}', '{dcbd6fa8-032f-11d3-b5b1-00c04fc324a1}','{e429b25a-e5d3-4d1f-9be3-0c608477e3a1}', '{f25e9f57-2fc8-4eb3-a41a-cce5f08541e6}','{fa445657-9379-11d6-b41a-00065b83ee53}' ) | ForEach-Object { [regex]::Escape($_) }) -join '|' $InboxPattern = 'TIP\\(?:' + $InboxIMEs + ')' $LanguageProfiles = Get-Item 'HKLM:\SOFTWARE\Microsoft\CTF\TIP\{????????-????-????-????-????????????}\LanguageProfile\0x*\{????????-????-????-????-????????????}' -EA SilentlyContinue foreach ($prof in @($LanguageProfiles)) { if ($prof.PSPath -match $InboxPattern) { continue } $pp = Get-ItemProperty $prof.PSPath -EA SilentlyContinue $hasEnable = ($pp.PSObject.Properties.Name -contains 'Enable') if ((-not $hasEnable) -or ($pp.Enable -eq 1)) { $Res = 1 break } } Write-Host 'Final result:',$Res
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3300

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            103621DE9CD5414CC2538780B4B75751
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
            • Size 808B
            • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8CE4A33FEB8CD35F8F6C8D2BE260E617
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
            • Size 192KB
            • SHA256 545404403ce68549bb4dc568f06fe018d8f85cd0c19b588a30565b222e22115d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            F15827BEC5BABE89C21DCDAE77464BF1
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
            • Size 701B
            • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            103621DE9CD5414CC2538780B4B75751
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
            • Size 192B
            • SHA256 0625e3c67d79d167956cf4781f96c26a5796dd8860763f9f502292cbbf3287a0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8CE4A33FEB8CD35F8F6C8D2BE260E617
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
            • Size 246B
            • SHA256 ebccbc9cce068624c7f23d782d5339a3e84372a5e6ca586c4096be7592d482fa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            F15827BEC5BABE89C21DCDAE77464BF1
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
            • Size 192B
            • SHA256 a13781d0c8ab3deb6850a58364e0bcbf025a18c2af57f2e7baaf5aefecb37667
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            microsoftedgeupdatecore32.exe
            • Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
            • Size 257KB
            • SHA256 eb0763b1876ae8b21b35dd8c132aecb94ac811983623ecd47902b8d938c85a3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            redevlist.dat
            • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
            • Size 12KB
            • SHA256 b914bf865a5fdef490dc431fb624e283b5756d72002b345b84db05cf8b89b720
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            redevlist.dat
            • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
            • Size 206KB
            • SHA256 e5d2aa0011ff6c0b86aa90b397f39e4905c540dfe1c14e0ef2efb66078dfc6d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            eventviewer.exe
            • Path C:\Windows\SysWOW64\eventviewer.exe
            • Size 88KB
            • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_1ztu2xbt.pck.psm1
            • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_1ztu2xbt.pck.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Appraiser_Data.ini
            • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_Data.ini
            • Size 150KB
            • SHA256 1826ba398e25e2cc9f11c7c6d07bcafe1474fc164b4521ed136a2604e898d2a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Appraiser_TelemetryRunList.xml
            • Path C:\Windows\appcompat\appraiser\AltData\Appraiser_TelemetryRunList.xml
            • Size 122KB
            • SHA256 ce7fee4281721b68ec1ebdafd5a91edf492ac19a2177065d9ae96cfc0f9759b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Appraiser_AlternateData.cab
            • Path C:\Windows\appcompat\appraiser\Appraiser_AlternateData.cab
            • Size 1.9MB
            • SHA256 f6b305de73aa37447679375c63440040a2de47d385ef8891f1f6b814b3149ab6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            4131645160.pri
            • Path C:\Windows\rescache\_merged\1638622442\4131645160.pri
            • Size 29KB
            • SHA256 dd7dc8ffa250b7f5b19d1b53e0e4a29dc745da24e1bb9de46a7ec9ec5c53b89a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3950159057.pri
            • Path C:\Windows\rescache\_merged\1977858686\3950159057.pri
            • Size 3KB
            • SHA256 41ed227cf36cb4b95efd069716c3549a5581dc6b0fade48f8b9d47fdefb19e96
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2059940924.pri
            • Path C:\Windows\rescache\_merged\2118023660\2059940924.pri
            • Size 2KB
            • SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2099836893.pri
            • Path C:\Windows\rescache\_merged\2162093802\2099836893.pri
            • Size 3KB
            • SHA256 f6bc68a8c0971cc7adb8e26e6ffc4454555201133e4bbbb25fd83ecfa6198b00
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            3879429115.pri
            • Path C:\Windows\rescache\_merged\2593639908\3879429115.pri
            • Size 3KB
            • SHA256 16b5b56e93a411e81c41d9ec5778093e542eb33964abe15cd66b3bd36366065f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            1601596005.pri
            • Path C:\Windows\rescache\_merged\3162402934\1601596005.pri
            • Size 16KB
            • SHA256 ae9baf74b0607586441a6189666f9057bac505f3574d58645f6ce35eebc9ba92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            360221107.pri
            • Path C:\Windows\rescache\_merged\3256312277\360221107.pri
            • Size 24KB
            • SHA256 cad4bece831162f88934ec9a76436f641205412e91a88cac8f54055679b94fc6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            1190289880.pri
            • Path C:\Windows\rescache\_merged\3763043174\1190289880.pri
            • Size 26KB
            • SHA256 f1ec449ab4bf5b998e753adc4e7a68b1734e50a3bb38e7f92b78a959b2c3fe42
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            528683609.pri
            • Path C:\Windows\rescache\_merged\3772624673\528683609.pri
            • Size 67KB
            • SHA256 f79487656252176acec585b2137cb4b99ef4be810895b50164d65de6b97f813f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3832575369.pri
            • Path C:\Windows\rescache\_merged\3906713228\3832575369.pri
            • Size 167KB
            • SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            447191601.pri
            • Path C:\Windows\rescache\_merged\4015152413\447191601.pri
            • Size 5KB
            • SHA256 f32dd062b8de11eabfbd7c7d581d88c2b89cb652395014b62101edb8f5a814db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3111975949.pri
            • Path C:\Windows\rescache\_merged\4045331080\3111975949.pri
            • Size 2KB
            • SHA256 d9ccf41116218ccf9bb9d6c46a506d6cf5bc57ffe791977d9ee23c87dae38075
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            3110106107.pri
            • Path C:\Windows\rescache\_merged\4136552255\3110106107.pri
            • Size 6KB
            • SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3039077256.pri
            • Path C:\Windows\rescache\_merged\4140704494\3039077256.pri
            • Size 2KB
            • SHA256 d3e3b60d1587edf171606b1280c049480f87a878bfd86e72b3f1c479215d09d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2500598541.pri
            • Path C:\Windows\rescache\_merged\414160718\2500598541.pri
            • Size 6KB
            • SHA256 27232704d827d6abb26ab8ccc520d26ce2e8724995af63649e7fff1b487bec8a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2072255136.pri
            • Path C:\Windows\rescache\_merged\4264460956\2072255136.pri
            • Size 4KB
            • SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3585238608.pri
            • Path C:\Windows\rescache\_merged\516575514\3585238608.pri
            • Size 16KB
            • SHA256 85bd66d61570ab1e095dedddebbcaaa953dec601969532995a3f8a18da6c34fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2478612193.pri
            • Path C:\Windows\rescache\_merged\582800500\2478612193.pri
            • Size 5KB
            • SHA256 4370ac9147e544757382eba8c963c3d688803470ac03cf65a2962b2ae7099b2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2648848960.pri
            • Path C:\Windows\rescache\_merged\617730634\2648848960.pri
            • Size 5KB
            • SHA256 ece4ebd1a23a54a80c62c490ff87b77632cc0be47264d557db939830972e5a9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            1712129766.pri
            • Path C:\Windows\rescache\_merged\645192682\1712129766.pri
            • Size 18KB
            • SHA256 3352aef67d36afcf39ecbf27fe1216a636636cd22c433719755c879605162e50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            3257770606.pri
            • Path C:\Windows\rescache\_merged\821860627\3257770606.pri
            • Size 2KB
            • SHA256 0144cca631f2ce5ef5e53cb9fa262eef6ac04197970d6e5fe3b4b02d22667945
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            1000058294.pri
            • Path C:\Windows\rescache\_merged\887518199\1000058294.pri
            • Size 3KB
            • SHA256 53361484f1895a3167a9862ff527b7c361f6798f88023fc67830fe3c231af263
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            3073553056.pri
            • Path C:\Windows\rescache\_merged\889867609\3073553056.pri
            • Size 3KB
            • SHA256 514f02ccc55ee42512bfe8f6bbb3da106593cf2a9ad554a2c1db044b7be648d5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 7f2553bf2ca63ece8869819d8a0cab7f3c8098426829233f4b75b68baff4c28f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 032a30d5e80b2e7df76b9efc77c80afbf0311d1f7ad9be2343c900ec6ded241d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 b3ff73e904f4d4e5900938d0534ad7459de001fc3dfcffd56bb1568f648dda91
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2660-1200-0x00000253671A0000-0x00000253671C2000-memory.dmp
            Download

            memory/5388-1198-0x0000018FFCE50000-0x0000018FFCE51000-memory.dmp
            Download