Overview

overview

10

Static

static

3

2026-02-11...ry.exe

windows10-2004-x64

10

2026-02-11...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/02/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe
  • Size 5.3MB
  • Sample260211-cf2mtsey5c
  • SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionavaddonransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\signatures\known_onion_urls.json

  • avaddon

Ransom Note
  • [ { "url": "marketojbwagqnwx.onion", "family": "marketo" }, { "url": "g5sbltooh2okkcb2.onion", "family": "marketo" }, { "url": "fvki3hj7uxuirxpeop6chgqoczanmebutznt2mkzy6waov6w456vjuid.onion", "family": "marketo" }, { "url": "jvdamsif53dqjycuozlaye2s47p7xij4x6hzwzwhzrqmv36gkyzohhqd.onion", "family": "marketo" }, { "url": "xqkz2rmrqkeqf6sjbrb47jfwnqxcd4o2zvaxxzrpbh2piknms37rw2ad.onion", "family": "synack" }, { "url": "x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion", "family": "suncrypt" }, { "url": "nbzzb6sa6xuura2z.onion", "family": "suncrypt" }, { "url": "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion", "family": "lv" }, { "url": "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion", "family": "lv" }, { "url": "lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion", "family": "lorenz" }, { "url": "zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion", "family": "lockbit2" }, { "url": "yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion", "family": "lockbit2" }, { "url": "oyarbnujct53bizjguvolxou3rmuda2vr72osyexngbdkhqebwrzsnad.onion", "family": "lockbit2" }, { "url": "lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion", "family": "lockbit2" }, { "url": "lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion", "family": "lockbit2" }, { "url": "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion", "family": "hiveleak" }, { "url": "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "family": "hiveleak" }, { "url": "hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion", "family": "hiveleak" }, { "url": "3kp6j22pz3zkv76yutctosa6djpj4yib2icvdqxucdaxxedumhqicpad.onion", "family": "arvinclub" }, { "url": "arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion", "family": "arvinclub" }, { "url": "avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion", "family": "avoslocker" }, { "url": "avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion", "family": "avoslocker" }, { "url": "griefcameifmv4hfr3auozmovz5yi6m3h3dwbuqw7baomfxoxz4qteid.onion", "family": "grief" }, { "url": "avaddongun7rngel.onion", "family": "avaddon" }, { "url": "4hzyuotli6maqa4u.onion", "family": "vicesociety" }, { "url": "vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion", "family": "vicesociety" }, { "url": "ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion", "family": "vicesociety" }, { "url": "wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion", "family": "vicesociety" }, { "url": "ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion", "family": "vicesociety" }, { "url": "ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion", "family": "vicesociety" }, { "url": "xingnewj6m4qytljhfwemngm7r7rogrindbq7wrfeepejgxc3bwci7qd.onion", "family": "xinglocker" }, { "url": "darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion", "family": "darkside" }, { "url": "rgleak7op734elep.onion", "family": "ragnarlocker" }, { "url": "rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion", "family": "ragnarlocker" }, { "url": "p6o7m73ujalhgkiv.onion", "family": "ragnarlocker" }, { "url": "ragnarnwvli32xnmwudsvhbl7klzmofxeylyhcqfc5ifx5mbybq3ekqd.onion", "family": "ragnarlocker" }, { "url": "ekbgzchl6x2ias37.onion", "family": "clop" }, { "url": "santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion", "family": "clop" }, { "url": "toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion", "family": "clop" }, { "url": "rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion", "family": "netwalker" }, { "url": "hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion", "family": "doppelpaymer" }, { "url": "dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion", "family": "revil" }, { "url": "aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion", "family": "revil" }, { "url": "blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion", "family": "revil" }, { "url": "ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion", "family": "everest" }, { "url": "ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion", "family": "everest" }, { "url": "wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion", "family": "ragnarok" }, { "url": "sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion", "family": "ragnarok" }, { "url": "continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion", "family": "conti" }, { "url": "pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion", "family": "pysa" }, { "url": "hxt254aygrsziejn.onion", "family": "nefilim" }, { "url": "xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion", "family": "maze" }, { "url": "mountnewsokhwilx.onion", "family": "mount-locker" }, { "url": "nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion", "family": "babuk" }, { "url": "rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion", "family": "ransomexx" }, { "url": "cuba4mp6ximo2zlo.onion", "family": "cuba" }, { "url": "cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion", "family": "cuba" }, { "url": "pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion", "family": "pay2key" }, { "url": "anewset3pcya3xvk73hj7yunuamutxxsm5sohkdi32blhmql55tvgqad.onion", "family": "aztroteam" }, { "url": "wm6mbuzipviusuc42kcggzkdpbhuv45sn7olyamy6mcqqked3waslbqd.onion", "family": "lockdata" }, { "url": "bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion", "family": "blacktor" }, { "url": "ft4zr2jzlqoyob7yg4fcpwyt37hox3ajajqnfkdvbfrkjioyunmqnpad.onion", "family": "haron" }, { "url": "54rdhzjzc4ids4u4wata4zr4ywfon5wpz2ml4q3avelgadpvmdal2vqd.onion", "family": "darkleakmarket" }, { "url": "aby6efzmp7jzbwgidgqc6ghxi2vwpo6d7eaood5xuoxutrfofsmzcjqd.onion", "family": "darkleakmarket" }, { "url": "darklmmmfuonklpy6s3tmvk5mrcdi7iapaw6eka45esmoryiiuug6aid.onion", "family": "darkleakmarket" }, { "url": "darkleakyqmv62eweqwy4dnhaijg4m4dkburo73pzuqfdumcntqdokyd.onion", "family": "darkleakmarket" }, { "url": "promethw27cbrcot.onion", "family": "prometheus" }, { "url": "blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion", "family": "blackmatter" }, { "url": "vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion", "family": "payloadbin" }, { "url": "ws3dh6av66sjbxxkjpw5ao3wqzmtejnkzheswm4dz5rrwvular7xvkqd.onion", "family": "groove" }, { "url": "kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion", "family": "ako" }, { "url": "mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion", "family": "atomsilo" }, { "url": "l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion", "family": "atomsilo" }, { "url": "avos2fuj6olp6x36.onion", "family": "avos" }, { "url": "6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion", "family": "blackbyte" }, { "url": "f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion", "family": "blackbyte" }, { "url": "dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion", "family": "blackbyte" }, { "url": "fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion", "family": "blackbyte" }, { "url": "ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion", "family": "blackbyte" }, { "url": "jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion", "family": "blackbyte" }, { "url": "53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion", "family": "blackbyte" }, { "url": "tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion", "family": "blackbyte" }, { "url": "mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion", "family": "lolnek" }, { "url": "obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion", "family": "lolnek" }, { "url": "nclen75pwlgebpxpsqhlcnxsmdvpyrr7ogz36ehhatfmkvakeyden6ad.onion", "family": "lolnek" }, { "url": "mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion", "family": "lolnek" }, { "url": "544corkfh5hwhtn4.onion", "family": "blackshadow" }, { "url": "bonacifryrxr4siz6ptvokuihdzmjzpveruklxumflz5thmkgauty2qd.onion", "family": "bonacigroup" }, { "url": "d57uremugxjrafyg.onion", "family": "crylock" }, { "url": "veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion", "family": "ech0raix" }, { "url": "dg5fyig37abmivryrxlordrczn6d6r5wzcfe2msuo5mbbu2exnu46fid.onion", "family": "ep918" }, { "url": "7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion", "family": "exorcist" }, { "url": "ixltdyumdlthrtgx.onion", "family": "hades" }, { "url": "3r6n77mpe737w4sbxxxrpc5phbluv6xhtdl5ujpnlvmck5tc7blq2rqd.onion", "family": "hellokitty" }, { "url": "r6d636w47ncnaukrpvlhmtdbvbeltc6enfcuuow3jclpmyga7cz374qd.onion", "family": "hotarus" }, { "url": "3nvzqyo6l4wkrzumzu5aod7zbosq4ipgf7ifgj3hsvbcr5vcasordvqd.onion", "family": "karma" }, { "url": "lockbitkodidilol.onion", "family": "lockbit" }, { "url": "xembshruusobgbvxg4tcjs3jpdnks6xrr6nbokfxadcnlc53yxir22ad.onion", "family": "mbc" }, { "url": "5s4ixqul2enwxrqv.onion", "family": "mydecryptor" }, { "url": "n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion", "family": "n3tworm" }, { "url": "zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion", "family": "nemty" }, { "url": "5mvifa3xq5m7sou3xzaajfz7h6eserp5fnkwotohns5pgbb5oxty3zad.onion", "family": "onepercent" }, { "url": "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion", "family": "prolock" }, { "url": "gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion", "family": "qlocker" }, { "url": "37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion", "family": "ranzy" }, { "url": "vfokxcdzjbpehgit223vzdzwte47l3zcqtafj34qrr26htjo4uf3obid.onion", "family": "vfokx" }, { "url": "746pbrxl7acvrlhzshosye3b3udk4plurpxt2pp27pojfhkkaooqiiqd.onion", "family": "vfokx" }, { "url": "wj3b2wtj7u2bzup75tzhnso56bin6bnvsxcbwbfcuvzpc4vcixbywlid.onion", "family": "xinof" }, { "url": "spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion", "family": "spook" }, { "url": "wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion", "family": "RAMP" }, { "url": "rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion", "family": "RAMP" }, { "url": "ramp4u5iz4xx75vmt6nk5xfrs5mrmtokzszqxhhkjqlk7pbwykaz7zid.onion", "family": "RAMP" }, { "url": "54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion", "family": "sabbath" }, { "url": "quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion", "family": "quantum" }, { "url": "22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion", "family": "quantum" }, { "url": "qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion", "family": "medusa" }, { "url": "medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion", "family": "medusa" }, { "url": "medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion", "family": "medusa" }, { "url": "xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion", "family": "medusa" }, { "url": "kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion", "family": "medusa" }, { "url": "s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion", "family": "medusa" }, { "url": "cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion", "family": "medusa" }, { "url": "62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion", "family": "medusa" }, { "url": "hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion", "family": "snatch" }, { "url": "midasbkic5eyfox4dhnijkzc7v7e4hpmsb2qgux7diqbpna4up4rtdad.onion", "family": "midas" }, { "url": "leaksv7sroztl377bbohzl42i3ddlfsxopcb6355zc7olzigedm5agad.onion", "family": "entropy" }, { "url": "mosesstaffm7hptp.onion", "family": "mosesstaff" }, { "url": "z6mikrtphid5fmn52nbcbg25tj57sowlm3oc25g563yvsfmygkcxqbyd.onion", "family": "cooming" }, { "url": "teo7aj5mfgzxyeme.onion", "family": "cooming" }, { "url": "gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion", "family": "rook" }, { "url": "tdoe2fiiamwkiadhx2a4dfq56ztlqhzl2vckgwmjtoanfaya4kqvvvyd.onion", "family": "unknown" }, { "url": "darktorhvabc652txfc575oendhykqcllb7bh7jhhsjduocdlyzdbmqd.onion", "family": "unknown" }, { "url": "t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion", "family": "rransom" }, { "url": "babydovegkmhbontykziyq7qivwzy33mu4ukqefe4mqpiiwd3wibnjqd.onion", "family": "babyduck" }, { "url": "alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion", "family": "alphv" }, { "url": "2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion", "family": "alphv" }, { "url": "vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion", "family": "alphv" }, { "url": "alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion", "family": "alphv" }, { "url": "7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion", "family": "cryp70n1c0d3" }, { "url": "dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion", "family": "dread" }, { "url": "giphvoitymatg4cv7bxqh5dz6sn6bfscywoat4qtslztkomf5lavrayd.onion", "family": "againstthewest" }, { "url": "matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion", "family": "holyghost" }, { "url": "gg5ryfgogainisskdvh4y373ap3b2mxafcibeh2lvq5x7fx76ygcosad.onion", "family": "nightsky" }, { "url": "u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion", "family": "ransomcartel" }, { "url": "cartelirsn5l54ehcbalyyqtfb3j7be2rpvf6ujayaf5qqmg3vlwiayd.onion", "family": "ransomcartel" }, { "url": "cartelraqonekult2cxbzzz2ukiff7v6cav3w373uuhenybgqulxm5id.onion", "family": "ransomcartel" }, { "url": "adminavf4cikzbv6mbbp7ujpwhygnn2t3egiz2pswldj32krrml42wyd.onion", "family": "adminlocker" }, { "url": "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion", "family": "sugar" }, { "url": "zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion", "family": "zeon" }, { "url": "gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion", "family": "freecivilian" }, { "url": "vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion", "family": "pandora" }, { "url": "3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion", "family": "stormous" }, { "url": "h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion", "family": "stormous" }, { "url": "ransekgbpijp56bflufgxptwn5hej2rztx423v6sim2zrzz7xetnr2qd.onion", "family": "stormous" }, { "url": "pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion", "family": "stormous" }, { "url": "stmxylixiz4atpmkspvhkym4

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Avaddon family
    avaddon
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 47 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /query /fo CSV /v
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2112
    • C:\Windows\SysWOW64\net.exe
      "net" session
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2328
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_LogicalDisk | Where-Object { $_.DriveType -eq 2 -or $_.DriveType -eq 4 -or $_.DriveType -eq 5 } | Select DeviceID,VolumeName,DriveType,Size,FreeSpace | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4128
      • C:\Windows\SysWOW64\reagentc.exe
        "reagentc" /info
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1972
      • C:\Windows\SysWOW64\sfc.exe
        "sfc" /verifyonly
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4344
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $sr = Get-ComputerRestorePoint -ErrorAction SilentlyContinue if ($null -eq $sr) { 'NO_RESTORE_POINTS' } else { $sr.Count } } Catch { 'DISABLED_OR_ERROR' } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:32
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-Process | Select Name,Id,Path,@{N='StartTime';E={$_.StartTime.ToString('o')}} -ErrorAction SilentlyContinue | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3776
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_Service | Select Name,DisplayName,State,PathName,StartMode | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
      • C:\Windows\SysWOW64\auditpol.exe
        "auditpol" /get /category:* /r
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $st=(Get-Date).AddDays(-7); Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104;StartTime=$st} -MaxEvents 1000 | Select TimeCreated,Message } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:612
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=524} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='VSS';Level=2,3} -MaxEvents 50 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3276
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $histPath = (Get-PSReadlineOption).HistorySavePath if (Test-Path $histPath) { Get-Content $histPath -Tail 1000 | Where-Object { $_ -match 'vssadmin|shadowcopy|wbadmin|bcdedit|diskshadow' } | Select-Object -Last 20 } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3612
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_Service | Where-Object { $_.State -eq 'Stopped' -and $_.StartMode -eq 'Auto' } | Select Name,DisplayName,State,StartMode,PathName | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-SmbShare | Where-Object { $_.ShareType -eq 'FileSystemDirectory' } | Select Name,Path,Description | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2500
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem | Where-Object { $_.DisplayRoot -like '\\*' } | Select Name,DisplayRoot | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2684
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational';Id=21,25} -MaxEvents 20 -ErrorAction SilentlyContinue | Select TimeCreated,@{n='User';e={$_.Properties[0].Value}},@{n='Source';e={$_.Properties[2].Value}} } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Security';Id=5140,5145} -MaxEvents 50 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'ADMIN\$|C\$|IPC\$' } | Select TimeCreated,Message } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $feat = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue if ($feat -and $feat.State -eq 'Enabled') { [PSCustomObject]@{ SMBv1Enabled=$true; State=$feat.State } } } Catch { Try { $cfg = Get-SmbServerConfiguration -ErrorAction SilentlyContinue if ($cfg.EnableSMB1Protocol -eq $true) { [PSCustomObject]@{ SMBv1Enabled=$true; State='EnableSMB1Protocol=True' } } } Catch { @() } } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1660
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue $nla = $rdp.UserAuthentication $enabled = $rdp.fDenyTSConnections if ($enabled -eq 0 -and $nla -ne 1) { [PSCustomObject]@{ RDPEnabled=$true; NLADisabled=$true; NLAValue=$nla } } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1504
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $keys = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServices', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce' ) foreach ($key in $keys) { if (Test-Path $key) { Get-ItemProperty $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | Where-Object { $_.Name -notin @('PSPath','PSParentPath','PSChildName','PSProvider','PSDrive') } | ForEach-Object { $val = (Get-ItemProperty $key).$($_.Name) [PSCustomObject]@{ Key = $key Name = $_.Name Value = $val } } } } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102} -MaxEvents 20 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=104} -MaxEvents 20 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,LogName,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2328
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -ListLog Security,System,Application -ErrorAction SilentlyContinue | Select LogName,RecordCount,FileSize,LastWriteTime } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3848
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Security';Id=4663} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'lsass' } | Select TimeCreated,Message -First 10 } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=5805,5723} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=4742} -MaxEvents 30 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Computer Account.*changed|msDS-KeyCredentialLink' } $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $pref = Get-MpPreference -ErrorAction SilentlyContinue [PSCustomObject]@{ RealTimeMonitoring = $pref.DisableRealtimeMonitoring BehaviorMonitoring = $pref.DisableBehaviorMonitoring IOAVProtection = $pref.DisableIOAVProtection ScriptScanning = $pref.DisableScriptScanning ExclusionPaths = ($pref.ExclusionPath -join '; ') ExclusionExts = ($pref.ExclusionExtension -join '; ') ExclusionProcesses = ($pref.ExclusionProcess -join '; ') } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-NetFirewallProfile -ErrorAction SilentlyContinue | Select Name,Enabled } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1112
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational';Id=5001,5010,5012} -MaxEvents 20 -ErrorAction SilentlyContinue | Select TimeCreated,Id,Message } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3276
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-Process -ErrorAction SilentlyContinue | Select Id,ProcessName,Path } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3308
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Select LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess,State } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-DnsClientCache -ErrorAction SilentlyContinue | Select Entry,Data } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='Microsoft-Windows-Diagnostics-Scripted';Id=101,102} -MaxEvents 20 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'msdt\.exe.*PCWDiagnostic|ms-msdt:' } $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1768
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $key = Get-ItemProperty 'HKCR:\ms-msdt' -ErrorAction SilentlyContinue if ($key) { [PSCustomObject]@{ MSDTHandlerExists=$true; URLProtocol=$key.'URL Protocol' } } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4476
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $proxy = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction SilentlyContinue if ($proxy.ProxyEnable -eq 1) { [PSCustomObject]@{ ProxyEnabled=$true; ProxyServer=$proxy.ProxyServer } } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=4697} -MaxEvents 50 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2152
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match 'Temp|AppData|Users\\Public|Downloads' } | Select Name,DisplayName,PathName,State -First 20 } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3156
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'ltmdm' } | Select Name,State,PathName } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4324
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $filters = Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction SilentlyContinue | Select Name,Query $consumers = Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -ErrorAction SilentlyContinue | Select Name,CommandLineTemplate,ExecutablePath $bindings = Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Select Filter,Consumer $result = @() foreach ($f in $filters) { $result += [PSCustomObject]@{ Type='EventFilter'; Name=$f.Name; Detail=$f.Query } } foreach ($c in $consumers) { $cmd = if ($c.CommandLineTemplate) { $c.CommandLineTemplate } else { $c.ExecutablePath } $result += [PSCustomObject]@{ Type='CommandLineConsumer'; Name=$c.Name; Detail=$cmd } } foreach ($b in $bindings) { $result += [PSCustomObject]@{ Type='Binding'; Name='FilterToConsumer'; Detail=\"$($b.Filter) -> $($b.Consumer)\" } } $result } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5084
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $svc = Get-Service -Name Spooler -ErrorAction SilentlyContinue [PSCustomObject]@{ Status=$svc.Status.ToString(); StartType=$svc.StartType.ToString() } } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2580
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-PrinterDriver -ErrorAction SilentlyContinue | Select Name,PrinterEnvironment,InfPath -First 30 } Catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $disks = Get-PhysicalDisk -ErrorAction Stop $results = @() foreach ($d in $disks) { try { $r = $d | Get-StorageReliabilityCounter -ErrorAction Stop $results += [PSCustomObject]@{ Id = $d.DeviceId Name = $d.FriendlyName Media = [string]$d.MediaType Health = [string]$d.HealthStatus OpStatus = [string]$d.OperationalStatus Temp = $r.Temperature ReadErr = $r.ReadErrorsTotal WriteErr = $r.WriteErrorsTotal ReadErrU = $r.ReadErrorsUncorrected WriteErrU = $r.WriteErrorsUncorrected Wear = $r.Wear POH = $r.PowerOnHours } } catch {} } $results } catch { @() } | ConvertTo-Json -Depth 8"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2440
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$auto = @{} try { $val = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name NoDriveTypeAutoRun -ErrorAction Stop).NoDriveTypeAutoRun $auto['NoDriveTypeAutoRun'] = $val } catch { $auto['NoDriveTypeAutoRun'] = -1 } try { $val = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf' -ErrorAction Stop).'(default)' $auto['IniFileMapping'] = $val } catch { $auto['IniFileMapping'] = '' } $drives = @() Get-PSDrive -PSProvider FileSystem -ErrorAction SilentlyContinue | ForEach-Object { $root = $_.Root $inf = Join-Path $root 'autorun.inf' if (Test-Path $inf -ErrorAction SilentlyContinue) { $content = '' try { $content = Get-Content $inf -Raw -ErrorAction Stop -TotalCount 50 } catch {} $drives += [PSCustomObject]@{Drive=$root;Content=$content} } } @{Registry=$auto;AutorunFiles=$drives} | ConvertTo-Json -Depth 8"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4316
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { (Get-HotFix -EA Stop | Select-Object -ExpandProperty HotFixID) -join ',' } catch { '' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2104
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'SMB1' -ErrorAction Stop).'SMB1'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:3352
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -ErrorAction Stop).'UserAuthentication'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:2380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { Get-WinEvent -LogName 'System' -MaxEvents 50 -ErrorAction Stop | Where-Object { ($_.Id -eq 5805 -or $_.Id -eq 5723) -and $_.Message -match 'Netlogon' } | Measure-Object | Select-Object -ExpandProperty Count } catch { Write-Output '0' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:3012
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $s = Get-Service -Name 'Spooler' -ErrorAction Stop; if ($s.Status -eq 'Running') { Write-Output 'RUNNING' } else { Write-Output 'STOPPED' } } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2600
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $s = Get-Service -Name 'Spooler' -ErrorAction Stop; if ($s.Status -eq 'Running') { Write-Output 'RUNNING' } else { Write-Output 'STOPPED' } } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1640
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Test-Path 'Registry::HKCR\ms-msdt') { Write-Output 'EXISTS' } else { Write-Output 'MISSING' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:4084
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name 'ClientVersionToReport' -ErrorAction Stop).'ClientVersionToReport'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:1240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3' -Name '1001' -ErrorAction Stop).'1001'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:2440
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Item 'C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx' -ErrorAction SilentlyContinue) { Write-Output 'FOUND' } else { Write-Output 'NONE' }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:3052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Process -Name 'java' -ErrorAction SilentlyContinue) { Write-Output 'RUNNING' } else { Write-Output 'NONE' }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:4124
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'DisableCompression' -ErrorAction Stop).'DisableCompression'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2684
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name 'ClientVersionToReport' -ErrorAction Stop).'ClientVersionToReport'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:612
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\Temp\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:2876
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Users\*\AppData\Local\Temp\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:2156
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\System32\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:1504
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\SysWOW64\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:3936
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\ProgramData\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:4252
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Users\Public\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:2772
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\System32\drivers\*.sys' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:2380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $drivers = Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.State -eq 'Running' -and $_.PathName -ne $null } | Select-Object Name, DisplayName, PathName, State | ConvertTo-Json -Compress if ($drivers) { $drivers } else { '[]' } } catch { '[]' } "
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:4240
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $bcd = bcdedit /enum '{current}' 2>&1 $safeboot = $bcd | Select-String 'safeboot' if ($safeboot) { @{ safeboot_enabled = $true; detail = $safeboot.ToString().Trim() } | ConvertTo-Json -Compress } else { '{}' } } catch { '{}' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:1972
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $logs = Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Id -eq 4104 -and $_.Message -notmatch 'ransomnote_finder' } | Select-Object TimeCreated, Message -First 50 $suspicious = @() foreach ($log in $logs) { $msg = $log.Message if ($msg -match '(?i)(encodedcommand|invoke-expression|downloadstring|amsi|mimikatz|iex\s*\()') { $suspicious += @{ time = $log.TimeCreated.ToString('o') snippet = $msg.Substring(0, [Math]::Min(300, $msg.Length)) } } } $suspicious | ConvertTo-Json -Compress } catch { '[]' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:824
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $rmm_services = 'AnyDesk','TeamViewer','ScreenConnect','Splashtop','AteraAgent','Syncro','Action1','RustDesk','MeshAgent' $found = Get-Service -ErrorAction SilentlyContinue | Where-Object { $svc = $_.Name; $rmm_services | Where-Object { $svc -match $_ } } | Select-Object Name, DisplayName, Status, StartType | ConvertTo-Json -Compress if ($found) { $found } else { '[]' } } catch { '[]' } "
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:2468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $recent = Get-ChildItem 'C:\Users' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-72) } | Group-Object Extension -NoElement | Sort-Object Count -Descending | Select-Object Count, Name -First 10 | ConvertTo-Json -Compress if ($recent) { $recent } else { '[]' } } catch { '[]' } "
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:4476
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $bcd = bcdedit /enum '{current}' 2>&1 | Out-String $result = @{ raw = $bcd } if ($bcd -match 'safeboot') { $result['safeboot_found'] = $true $match = [regex]::Match($bcd, 'safeboot\s+(\S+)') if ($match.Success) { $result['safeboot_value'] = $match.Groups[1].Value } } # Check default boot entry $default = bcdedit /enum '{default}' 2>&1 | Out-String if ($default -match 'safeboot') { $result['default_safeboot'] = $true } $result | ConvertTo-Json -Compress } catch { '{}' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:4792
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $safeMinimal = 'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal' $unusual = @() if (Test-Path $safeMinimal) { $keys = Get-ChildItem $safeMinimal -ErrorAction SilentlyContinue foreach ($key in $keys) { $name = $key.PSChildName # Blacklist approach: entry is legitimate if it matches ANY of: # 1. Device class GUID ({xxxxxxxx-...}) # 2. Registered Windows service # 3. Known OS component (drivers, core services) $isLegit = $false # GUIDs are always device class identifiers (legitimate) if ($name -match '^\{') { $isLegit = $true } # Known Windows core SafeBoot entries (comprehensive list) if (-not $isLegit) { $knownOS = @('Ahcache.sys','AppInfo','AppXSvc','Base', 'BasicDisplay.sys','BasicRender.sys','Boot Bus Extender', 'Boot File System','cdd.dll','CoreMessagingRegistrar', 'CryptSvc','DcomLaunch','DeviceInstall','DeviceSetupManager', 'dxgkrnl.sys','EFS','EventLog','File system','Filter', 'FilterManager','FontCache','FsDepends','FsDepends.sys', 'HdAudAddService.Sys','HdAudBus.sys','HelpSvc','HidSpiCx.sys', 'Kernel','KeyIso','LSM','luafv.sys', 'Netlogon','netprofm','NetworkListSvc','NetworkProvider', 'nsi','NTDS','PCI Configuration','PNP Filter','PNP_STATUS', 'Power','Primary disk','ProfSvc', 'RpcEptMapper','rpcss','RpcSs','sacsvr','SamSs','SCardSvr', 'SCSI Class','SecurityProviders','SerCx2.sys','sermouse.sys', 'ServiceModelEndpoint 4.0.0.0','ShellHWDetection','SpbCx.sys', 'sppsvc','StateRepository','StorSvc','System Bus Extender', 'SystemEventsBroker','TBS','TDI','TimeBrokerSvc','TrustedInstaller', 'uefi.sys','UGTHRSVC','usbaudio.sys','usbaudio2.sys', 'USBHUB3.sys','USBXHCI.sys','UserManager','VDS','VGA', 'vmms','volmgr.sys','volmgrx.sys','volsnap.sys', 'VSS','W32Time','WarpJITSvc','Wdf01000','Wdf01000.sys', 'WinDefend','WinMgmt','Winmgmt','WudfPf','WudfRd', 'AudioEndpointBuilder','AudioSrv','BFE','BITS', 'BrokerInfrastructure','CoreUI','DsSvc','EventSystem', 'gpsvc','IKEEXT','iphlpsvc','LanmanServer', 'LanmanWorkstation','MpsSvc','NcbService','Ndisuio.sys', 'NlaSvc','nsiproxy.sys','PolicyAgent','Schedule','SENS', 'Themes','TokenBroker','UmPass.sys','Wcmsvc', 'WinHttpAutoProxySvc','Winmgmt','WlanSvc','WPDBusEnum', 'wuauserv','WwanSvc','disk.sys','partmgr.sys','fvevol.sys', 'rdyboost.sys','mup.sys','iorate.sys','intelpep.sys', 'WindowsTrustedRT','WindowsTrustedRTProxy', 'storahci.sys','stornvme.sys','EhStorClass.sys', 'vmbus.sys','hyperkbd.sys','dmvsc.sys','vmbkmcl.sys') if ($knownOS -contains $name) { $isLegit = $true } } # Fallback: check if it's a registered service if (-not $isLegit) { $svc = Get-Service -Name $name -ErrorAction SilentlyContinue if ($svc) { $isLegit = $true } } if (-not $isLegit) { $unusual += @{ name = $name; path = $key.Name } } } } $unusual | ConvertTo-Json -Compress } catch { '[]' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Network Service Discovery
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:3848
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $pending = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'BootExecute' -ErrorAction SilentlyContinue $reboot = @{} if ($pending -and $pending.BootExecute -match 'safeboot') { $reboot['pending_safeboot'] = $true } $reboot | ConvertTo-Json -Compress } catch { '{}' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:912
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $shadows = vssadmin list shadows 2>&1 | Out-String if ($shadows -match 'Shadow Copy Volume') { $count = ([regex]::Matches($shadows, 'Shadow Copy ID')).Count @{ available = $true; count = $count } | ConvertTo-Json -Compress } else { @{ available = $false; count = 0 } | ConvertTo-Json -Compress } } catch { @{ available = $false; count = 0 } | ConvertTo-Json -Compress } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        PID:444
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $result = @{} # RDP enabled check $rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction SilentlyContinue $result['rdp_enabled'] = ($rdp.fDenyTSConnections -eq 0) # NLA (Network Level Authentication) for RDP $nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -ErrorAction SilentlyContinue $result['nla_enabled'] = ($nla.UserAuthentication -eq 1) # SMBv1 check $smb1 = Get-SmbServerConfiguration -ErrorAction SilentlyContinue | Select-Object EnableSMB1Protocol if ($smb1) { $result['smbv1_enabled'] = $smb1.EnableSMB1Protocol } # Guest account $guest = Get-LocalUser -Name 'Guest' -ErrorAction SilentlyContinue if ($guest) { $result['guest_enabled'] = $guest.Enabled } # Windows Update - last install date $hotfix = Get-HotFix -ErrorAction SilentlyContinue | Sort-Object InstalledOn -Descending | Select-Object -First 1 if ($hotfix -and $hotfix.InstalledOn) { $result['last_patch'] = $hotfix.InstalledOn.ToString('yyyy-MM-dd') $days = ((Get-Date) - $hotfix.InstalledOn).Days $result['patch_age_days'] = $days } # Firewall status $fw = Get-NetFirewallProfile -ErrorAction SilentlyContinue | Select-Object Name, Enabled $result['firewall_profiles'] = ($fw | Where-Object { $_.Enabled } | ForEach-Object { $_.Name }) -join ',' # Admin shares $shares = Get-SmbShare -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '^\w\$|^ADMIN\$|^IPC\$' } $result['admin_shares'] = $shares.Count $result | ConvertTo-Json -Compress } catch { '{}' } "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:640
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $gpoPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History' if (Test-Path $gpoPath) { Get-ChildItem $gpoPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $displayName = $_.GetValue('DisplayName') $link = $_.GetValue('Link') $lastTime = $_.GetValue('lParam') if ($displayName) { [PSCustomObject]@{ Name = $displayName Link = $link Path = $_.PSPath } } } | ConvertTo-Json -Compress } else { '[]' } } catch { '[]' } "
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        PID:944
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Source -like '*Group Policy*' -or $_.TaskPath -like '*GPO*' } | Select-Object -First 10 TaskName, TaskPath, State | ConvertTo-Json -Compress if ($tasks) { $tasks } else { '[]' } } catch { '[]' } "
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • System Location Discovery: System Language Discovery
        PID:1412

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 1KB
          • SHA256 7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 f9966a081a159bfb23538d8e5886e9f784c1c2244aa0b390432cc24d1652cf4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 c20b8770e36508c169db766f820b2c0ebfd77de410876eee0f4324e28ec85acc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 5fde20e3a04cb8b8aa35f8bd687c370035e7f8997fe67ac8829ee3ea7b4f1fdc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 6635cde4a3b412d1eef399b50ddf3fdf7e329a359be653333f0989b462b252ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 700f2c9a539c55cb62282c8f900ff9501b6387f4418cdf8bb69a11ac794af18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 694225e14d05e4350be4f6d8ee1f58f9967e31bcd07164b9e90e44d01ba646d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 21KB
          • SHA256 f23fad9090fe29cfd2b5a7ef2b8600ee3c3326b83e62b27ddc9e067ea2716fea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 bd9620d1ee2e92990152dc26bc361df28db19dad2fd9d1d80845b53b7a353c77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 50ead2eb15f4b9553aea1a93ac5b7d5ea7ce0c9a186fdde30d752d7d8a06ebd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 93e39c9ac772d40fb45bdd9570198732d7fb94ffeb7d9733cf16b8fb40ae4996
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 e9c7241288b25a5d1b1eb6c434374c2688ef2819ce25e12cadeff70d5503383b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 ca55060042d20b7a6eb366b9e8179716e87b7f883641dc0cba74694772490f23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 0a589e497b93c2a83db196913a6d9b220b2fd9bb22d9b155a4a52228ea95f461
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 fbebe9d1b2e8426dfa3f714fe7412acd7b1f1ed4940cd879c3452adf32ea7ff3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 e3b2764520c212198140cda256d8bf7ac2c6bc094281915869a53b0fff99811d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 ac1497c7445cc8c0e4caaa4a53f6c98b4130e49ecd5dff9a627caa3dcffad9b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 d80300c2ead7c01b309af02b3e44454a409cc7fb61b7b4a06361566ef64a4240
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 c5b7de63d448aef32cc489bc04fed09da4312ac10e77c6ff30639a544038da21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 69fcb345abdc8a62b574f6ef46efd0310a7049105a92c58df3405ff89debcbed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 87969b5a51943e7261c6991cd827a2bd58d62b4db24aa7c9056351d0daf08122
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 a62f2fe4bc28036296a06089f8e2e3fd958ae92d1b7d89b239d1fdd794e71e00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 54d44e81aafef20405e009476fcb79183f54ea0af265316feccf6971f3c4d91f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 04a88d903bf72a94a2a43d8fc0f8f4b68db9ac0aea682ecc59d2cb3eb9abfae5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 6f3a1c0b25216957d9600a3844b7dcc903d13ece36b66c7ac1168ca6a478c9a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 3020705f4ea85d009890760fbf167aa82d62e45f9ac56c08b2f39d24d9170aea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 42b5f493c89f1d94d5588de2a45227e92430afb0011351288d6ed8a6dee4ca0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 38e9993aca8b34f076e1588db2fe9d847a5563e217b10a26cd8e8ec1ccd8fa5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 63aaf71c27b530cd769a27f63dd970d656cd1506f7f0e0b8864a4378221840ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 c9e8c3aa021380a9fe11be9fb76e56b752a51093b7835eaea9dbd0f8ee4835fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 567ff3748546d94ec5b546363ae6cdfe56200615056f1d2e3b8f4d2e5d9250c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 024ab0e4a054dc6f9e9fcda24047a25e0d811748f57d8a23c596ea5abeb2b68e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 0d59a1342d036c910b7d83bfc8115795375a9f5e9d9c125491685f0af8967b5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 15KB
          • SHA256 2b1be8ea243747d1b47570911bbc6f2c5c255c363d71dd9a2082f63cc1e57f72
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 19KB
          • SHA256 1973933f9065f677b44f5599b40e46ac434585f8d49d6f3785dce704a4d834ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 9f438a18fa28ca3f288aa511b183cb4a12cdb81ab7e95d33d4f25e2026d9a9a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 4cea0684e431f55062807b9adbec2357f134e4b503679aaa9d6302aa7011d5f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 24121c5e4d91fde72ae35dab841d5c11a099ae97b613936bdd4b51ff5181cbdd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 42dc3239ee4fff50c7e0aff02a59ab26de2fd5027ed6c4ee8d90ad839a0315e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 fd078bcb3f8740901fd5a7b30eba34187305b61728468656a0d7af1f591bf62e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 227485b1ec67df9ccc4bf75bfec68e7c2f0e760bf0a2d8e54af88b47191c687c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 379cc312654209fc510bbf015cfa6419b0d51760a16ac6ef8257f7139e2a89c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 9bd073afbe3edefe72d3fc2b48d144d38f9bf59b8b6d6a4282a1577b2a0f6dfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 b5ecc0557aa6c2b49cd5fee4097552077ab814570a1e2d76257a3a241b92abee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 574df5c196c60e7ed294e9396fcd3c7f22fbffc54efb8ca17f6a2c557c543f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 aff2a088e8fd3dea0982e32bd37fa7c0d2b0b7685847e54ec92c17cfee03ec97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 1b13ab21e38318df4cd88674a913c64faa2d609d7a004d7566ed81aed2b39ac8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 3f9e54bd5912870f99563a2dbd702af0461ce29876a98f10945722a2b45b16cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 9196333031bb213f80f957685ea053215e6a5d1e9ddffdd322a28ec422154611
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 2110d6b24a44483d98f9b8c89e4778143cb008c6589ca4a32629559ba3509484
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 875532648430ca597d9e945fa933ccb26ffddd53c7decd8904fe8fcbc1742a2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 461c6b862d242dd42532cca0e652a367e5640474802487c63366463ce38346b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 89ce818255db7d491ba97276f8593961d5a3f22f0ae110595d9b258d214864b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 5a3a41c81bd2705593bab5480fe77d40d3f46776aff3c3ce99598152d68eab74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 d626b33abd0d557aa5cc3f83839ced936d8401113819c1f95c086687d5c1a9e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 db760e608fee61ccc8c7ba3de12abcd98e3763ef72a5db2cc4200815ef7c5c48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 fe3ef051dde8b59f9f0d592d6403843698032f4dd25e754b65006ec3fa477352
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 a675ce9df30ed6fad22c69aac70cddc7231a0c1cb15a5fdb1b6234433e06b78a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 63f98c9510c2b3da87ad8433c5b54bf6bf41d638e0e5f9b7f673cf3b75341d13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 17KB
          • SHA256 649cebfa644da76d2485de10c4ca727ec66d99c9159c9ca24682585190981e27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 18KB
          • SHA256 2281eb77ec70afd2b071d6e718d39ef2327797f4e1d4f68c9a93fb56a60563b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_v43l3g11.ekm.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v43l3g11.ekm.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          c2_ips.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\c2_ips.json
          • Size 47KB
          • SHA256 6207d53a48f4d554b11535e3a1e52c655b8ff2c55e0401bd3c3cef62a7a5eb03
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cve_rules.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\cve_rules.json
          • Size 173KB
          • SHA256 c9f86e5cac6e2a1a71f9bbb9ddacfb3c86fb7573956e522e104b7d28459b543f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          extensions.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\extensions.json
          • Size 2KB
          • SHA256 72deb038167a0299cbc92f62e2ffd7b1125d1b80a56640894e1f4d1d71bce3fa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          feed_meta.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\feed_meta.json
          • Size 594B
          • SHA256 6e86ac797642eb27abc4cbf0ce180f7dbdbafbcf4ace41e7e221b736bf4e0938
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          known_onion_urls.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\known_onion_urls.json
          • Size 48KB
          • SHA256 fb10cf713ce84760beeb909a81b207805035fd488c91923bce1cdeb31e79cec0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          known_wallets.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\known_wallets.json
          • Size 2KB
          • SHA256 a564298542fba156c68847f4407a07f56d988b85c36ffc4467ad9f1413f4bb23
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ransom_filenames.json
          • Path C:\Users\Admin\AppData\Local\Temp\signatures\ransom_filenames.json
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          ReAgent.log
          • Path C:\Windows\Logs\ReAgent\ReAgent.log
          • Size 3KB
          • SHA256 fa91c8a9249fa5be5b4448bed3ac98f1caab61f62a3de05b16fe5f8b6d58fdfb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ReAgent.log
          • Path C:\Windows\Logs\ReAgent\ReAgent.log
          • Size 2KB
          • SHA256 ca33c086ce6f207342f4f417f8b5994c88ceb066f00c0d0cf8cc5e00ffb53c6e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/32-36-0x0000000005080000-0x0000000005090000-memory.dmp
          Download

          memory/32-59-0x0000000004ED0000-0x0000000004EFF000-memory.dmp
          Download

          memory/32-35-0x0000000005080000-0x0000000005090000-memory.dmp
          Download

          memory/32-56-0x0000000006560000-0x00000000065AC000-memory.dmp
          Download

          memory/32-55-0x0000000005270000-0x000000000528E000-memory.dmp
          Download

          memory/32-61-0x0000000005F30000-0x0000000005F48000-memory.dmp
          Download

          memory/32-60-0x0000000005D00000-0x0000000005D3C000-memory.dmp
          Download

          memory/32-62-0x0000000005250000-0x000000000525A000-memory.dmp
          Download

          memory/436-163-0x0000000007D10000-0x0000000007D18000-memory.dmp
          Download

          memory/436-162-0x0000000007D30000-0x0000000007D62000-memory.dmp
          Download

          memory/444-790-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/640-806-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/640-822-0x0000000007810000-0x0000000007824000-memory.dmp
          Download

          memory/640-814-0x0000000071210000-0x0000000071564000-memory.dmp
          Download

          memory/824-724-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/1412-839-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/1504-606-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/1972-704-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/1972-712-0x0000000007F10000-0x0000000007F24000-memory.dmp
          Download

          memory/1972-713-0x0000000008000000-0x000000000801A000-memory.dmp
          Download

          memory/1972-714-0x0000000007F40000-0x0000000007F48000-memory.dmp
          Download

          memory/2104-442-0x00000000073F0000-0x0000000007422000-memory.dmp
          Download

          memory/2104-443-0x00000000073D0000-0x00000000073D8000-memory.dmp
          Download

          memory/2156-589-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/2380-658-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/2440-523-0x0000000005FB0000-0x0000000006304000-memory.dmp
          Download

          memory/2500-173-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/2500-182-0x0000000007250000-0x00000000072F3000-memory.dmp
          Download

          memory/2500-181-0x0000000007220000-0x000000000723E000-memory.dmp
          Download

          memory/2500-185-0x00000000075B0000-0x00000000075BE000-memory.dmp
          Download

          memory/2500-172-0x00000000071E0000-0x0000000007212000-memory.dmp
          Download

          memory/2500-184-0x0000000007580000-0x0000000007591000-memory.dmp
          Download

          memory/2500-183-0x00000000073F0000-0x00000000073FA000-memory.dmp
          Download

          memory/2600-484-0x0000000005850000-0x0000000005BA4000-memory.dmp
          Download

          memory/2684-195-0x0000000007450000-0x000000000749A000-memory.dmp
          Download

          memory/3012-470-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/3052-533-0x00000000060C0000-0x0000000006414000-memory.dmp
          Download

          memory/3276-140-0x0000000005A80000-0x0000000005DD4000-memory.dmp
          Download

          memory/3612-150-0x0000000005700000-0x0000000005A54000-memory.dmp
          Download

          memory/3716-123-0x00000000078F0000-0x00000000078F8000-memory.dmp
          Download

          memory/3716-122-0x0000000007920000-0x0000000007952000-memory.dmp
          Download

          memory/3716-119-0x0000000005F80000-0x00000000062D4000-memory.dmp
          Download

          memory/3776-110-0x0000000006760000-0x00000000067AC000-memory.dmp
          Download

          memory/3776-107-0x0000000005BD0000-0x0000000005F24000-memory.dmp
          Download

          memory/3788-204-0x0000000006160000-0x00000000064B4000-memory.dmp
          Download

          memory/3848-252-0x0000000005550000-0x00000000058A4000-memory.dmp
          Download

          memory/3936-623-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download

          memory/4128-74-0x00000000074B0000-0x00000000074CD000-memory.dmp
          Download

          memory/4128-12-0x0000000002AF0000-0x0000000002B26000-memory.dmp
          Download

          memory/4128-38-0x0000000005900000-0x0000000005966000-memory.dmp
          Download

          memory/4128-37-0x0000000005140000-0x0000000005162000-memory.dmp
          Download

          memory/4128-33-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
          Download

          memory/4128-39-0x0000000005970000-0x00000000059D6000-memory.dmp
          Download

          memory/4128-45-0x0000000005AE0000-0x0000000005E34000-memory.dmp
          Download

          memory/4128-63-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
          Download

          memory/4128-64-0x0000000007190000-0x0000000007226000-memory.dmp
          Download

          memory/4128-66-0x0000000006670000-0x0000000006692000-memory.dmp
          Download

          memory/4128-65-0x00000000065A0000-0x00000000065BA000-memory.dmp
          Download

          memory/4128-67-0x00000000077E0000-0x0000000007D84000-memory.dmp
          Download

          memory/4128-82-0x0000000005F60000-0x0000000005F78000-memory.dmp
          Download

          memory/4128-84-0x00000000074B0000-0x00000000074CD000-memory.dmp
          Download

          memory/4128-34-0x0000000005220000-0x0000000005848000-memory.dmp
          Download

          memory/4128-72-0x0000000005F60000-0x0000000005F78000-memory.dmp
          Download

          memory/4128-68-0x0000000008410000-0x0000000008A8A000-memory.dmp
          Download

          memory/4128-71-0x00000000058B0000-0x00000000058EC000-memory.dmp
          Download

          memory/4128-13-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
          Download

          memory/4128-69-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
          Download

          memory/4128-73-0x0000000006660000-0x000000000666A000-memory.dmp
          Download

          memory/4128-70-0x0000000002AA0000-0x0000000002ACF000-memory.dmp
          Download

          memory/4128-75-0x0000000007D90000-0x0000000007F52000-memory.dmp
          Download

          memory/4128-80-0x0000000002AA0000-0x0000000002ACF000-memory.dmp
          Download

          memory/4128-76-0x0000000008FC0000-0x00000000094EC000-memory.dmp
          Download

          memory/4128-81-0x00000000058B0000-0x00000000058EC000-memory.dmp
          Download

          memory/4240-695-0x0000000007580000-0x0000000007588000-memory.dmp
          Download

          memory/4240-694-0x00000000074E0000-0x0000000007512000-memory.dmp
          Download

          memory/4792-758-0x0000000070A40000-0x0000000070A8C000-memory.dmp
          Download