Overview

overview

10

Static

static

3

2026-02-11...ry.exe

windows10-2004-x64

10

2026-02-11...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/02/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe
  • Size 5.3MB
  • Sample260211-cf2mtsey5c
  • SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionavaddonransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\signatures\known_onion_urls.json

  • avaddon

Ransom Note
  • [ { "url": "marketojbwagqnwx.onion", "family": "marketo" }, { "url": "g5sbltooh2okkcb2.onion", "family": "marketo" }, { "url": "fvki3hj7uxuirxpeop6chgqoczanmebutznt2mkzy6waov6w456vjuid.onion", "family": "marketo" }, { "url": "jvdamsif53dqjycuozlaye2s47p7xij4x6hzwzwhzrqmv36gkyzohhqd.onion", "family": "marketo" }, { "url": "xqkz2rmrqkeqf6sjbrb47jfwnqxcd4o2zvaxxzrpbh2piknms37rw2ad.onion", "family": "synack" }, { "url": "x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion", "family": "suncrypt" }, { "url": "nbzzb6sa6xuura2z.onion", "family": "suncrypt" }, { "url": "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion", "family": "lv" }, { "url": "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion", "family": "lv" }, { "url": "lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion", "family": "lorenz" }, { "url": "zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion", "family": "lockbit2" }, { "url": "yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion", "family": "lockbit2" }, { "url": "oyarbnujct53bizjguvolxou3rmuda2vr72osyexngbdkhqebwrzsnad.onion", "family": "lockbit2" }, { "url": "lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion", "family": "lockbit2" }, { "url": "lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion", "family": "lockbit2" }, { "url": "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion", "family": "hiveleak" }, { "url": "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "family": "hiveleak" }, { "url": "hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion", "family": "hiveleak" }, { "url": "3kp6j22pz3zkv76yutctosa6djpj4yib2icvdqxucdaxxedumhqicpad.onion", "family": "arvinclub" }, { "url": "arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion", "family": "arvinclub" }, { "url": "avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion", "family": "avoslocker" }, { "url": "avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion", "family": "avoslocker" }, { "url": "griefcameifmv4hfr3auozmovz5yi6m3h3dwbuqw7baomfxoxz4qteid.onion", "family": "grief" }, { "url": "avaddongun7rngel.onion", "family": "avaddon" }, { "url": "4hzyuotli6maqa4u.onion", "family": "vicesociety" }, { "url": "vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion", "family": "vicesociety" }, { "url": "ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion", "family": "vicesociety" }, { "url": "wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion", "family": "vicesociety" }, { "url": "ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion", "family": "vicesociety" }, { "url": "ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion", "family": "vicesociety" }, { "url": "xingnewj6m4qytljhfwemngm7r7rogrindbq7wrfeepejgxc3bwci7qd.onion", "family": "xinglocker" }, { "url": "darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion", "family": "darkside" }, { "url": "rgleak7op734elep.onion", "family": "ragnarlocker" }, { "url": "rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion", "family": "ragnarlocker" }, { "url": "p6o7m73ujalhgkiv.onion", "family": "ragnarlocker" }, { "url": "ragnarnwvli32xnmwudsvhbl7klzmofxeylyhcqfc5ifx5mbybq3ekqd.onion", "family": "ragnarlocker" }, { "url": "ekbgzchl6x2ias37.onion", "family": "clop" }, { "url": "santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion", "family": "clop" }, { "url": "toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion", "family": "clop" }, { "url": "rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion", "family": "netwalker" }, { "url": "hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion", "family": "doppelpaymer" }, { "url": "dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion", "family": "revil" }, { "url": "aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion", "family": "revil" }, { "url": "blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion", "family": "revil" }, { "url": "ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion", "family": "everest" }, { "url": "ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion", "family": "everest" }, { "url": "wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion", "family": "ragnarok" }, { "url": "sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion", "family": "ragnarok" }, { "url": "continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion", "family": "conti" }, { "url": "pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion", "family": "pysa" }, { "url": "hxt254aygrsziejn.onion", "family": "nefilim" }, { "url": "xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion", "family": "maze" }, { "url": "mountnewsokhwilx.onion", "family": "mount-locker" }, { "url": "nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion", "family": "babuk" }, { "url": "rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion", "family": "ransomexx" }, { "url": "cuba4mp6ximo2zlo.onion", "family": "cuba" }, { "url": "cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion", "family": "cuba" }, { "url": "pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion", "family": "pay2key" }, { "url": "anewset3pcya3xvk73hj7yunuamutxxsm5sohkdi32blhmql55tvgqad.onion", "family": "aztroteam" }, { "url": "wm6mbuzipviusuc42kcggzkdpbhuv45sn7olyamy6mcqqked3waslbqd.onion", "family": "lockdata" }, { "url": "bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion", "family": "blacktor" }, { "url": "ft4zr2jzlqoyob7yg4fcpwyt37hox3ajajqnfkdvbfrkjioyunmqnpad.onion", "family": "haron" }, { "url": "54rdhzjzc4ids4u4wata4zr4ywfon5wpz2ml4q3avelgadpvmdal2vqd.onion", "family": "darkleakmarket" }, { "url": "aby6efzmp7jzbwgidgqc6ghxi2vwpo6d7eaood5xuoxutrfofsmzcjqd.onion", "family": "darkleakmarket" }, { "url": "darklmmmfuonklpy6s3tmvk5mrcdi7iapaw6eka45esmoryiiuug6aid.onion", "family": "darkleakmarket" }, { "url": "darkleakyqmv62eweqwy4dnhaijg4m4dkburo73pzuqfdumcntqdokyd.onion", "family": "darkleakmarket" }, { "url": "promethw27cbrcot.onion", "family": "prometheus" }, { "url": "blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion", "family": "blackmatter" }, { "url": "vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion", "family": "payloadbin" }, { "url": "ws3dh6av66sjbxxkjpw5ao3wqzmtejnkzheswm4dz5rrwvular7xvkqd.onion", "family": "groove" }, { "url": "kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion", "family": "ako" }, { "url": "mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion", "family": "atomsilo" }, { "url": "l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion", "family": "atomsilo" }, { "url": "avos2fuj6olp6x36.onion", "family": "avos" }, { "url": "6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion", "family": "blackbyte" }, { "url": "f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion", "family": "blackbyte" }, { "url": "dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion", "family": "blackbyte" }, { "url": "fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion", "family": "blackbyte" }, { "url": "ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion", "family": "blackbyte" }, { "url": "jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion", "family": "blackbyte" }, { "url": "53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion", "family": "blackbyte" }, { "url": "tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion", "family": "blackbyte" }, { "url": "mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion", "family": "lolnek" }, { "url": "obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion", "family": "lolnek" }, { "url": "nclen75pwlgebpxpsqhlcnxsmdvpyrr7ogz36ehhatfmkvakeyden6ad.onion", "family": "lolnek" }, { "url": "mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion", "family": "lolnek" }, { "url": "544corkfh5hwhtn4.onion", "family": "blackshadow" }, { "url": "bonacifryrxr4siz6ptvokuihdzmjzpveruklxumflz5thmkgauty2qd.onion", "family": "bonacigroup" }, { "url": "d57uremugxjrafyg.onion", "family": "crylock" }, { "url": "veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion", "family": "ech0raix" }, { "url": "dg5fyig37abmivryrxlordrczn6d6r5wzcfe2msuo5mbbu2exnu46fid.onion", "family": "ep918" }, { "url": "7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion", "family": "exorcist" }, { "url": "ixltdyumdlthrtgx.onion", "family": "hades" }, { "url": "3r6n77mpe737w4sbxxxrpc5phbluv6xhtdl5ujpnlvmck5tc7blq2rqd.onion", "family": "hellokitty" }, { "url": "r6d636w47ncnaukrpvlhmtdbvbeltc6enfcuuow3jclpmyga7cz374qd.onion", "family": "hotarus" }, { "url": "3nvzqyo6l4wkrzumzu5aod7zbosq4ipgf7ifgj3hsvbcr5vcasordvqd.onion", "family": "karma" }, { "url": "lockbitkodidilol.onion", "family": "lockbit" }, { "url": "xembshruusobgbvxg4tcjs3jpdnks6xrr6nbokfxadcnlc53yxir22ad.onion", "family": "mbc" }, { "url": "5s4ixqul2enwxrqv.onion", "family": "mydecryptor" }, { "url": "n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion", "family": "n3tworm" }, { "url": "zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion", "family": "nemty" }, { "url": "5mvifa3xq5m7sou3xzaajfz7h6eserp5fnkwotohns5pgbb5oxty3zad.onion", "family": "onepercent" }, { "url": "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion", "family": "prolock" }, { "url": "gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion", "family": "qlocker" }, { "url": "37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion", "family": "ranzy" }, { "url": "vfokxcdzjbpehgit223vzdzwte47l3zcqtafj34qrr26htjo4uf3obid.onion", "family": "vfokx" }, { "url": "746pbrxl7acvrlhzshosye3b3udk4plurpxt2pp27pojfhkkaooqiiqd.onion", "family": "vfokx" }, { "url": "wj3b2wtj7u2bzup75tzhnso56bin6bnvsxcbwbfcuvzpc4vcixbywlid.onion", "family": "xinof" }, { "url": "spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion", "family": "spook" }, { "url": "wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion", "family": "RAMP" }, { "url": "rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion", "family": "RAMP" }, { "url": "ramp4u5iz4xx75vmt6nk5xfrs5mrmtokzszqxhhkjqlk7pbwykaz7zid.onion", "family": "RAMP" }, { "url": "54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion", "family": "sabbath" }, { "url": "quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion", "family": "quantum" }, { "url": "22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion", "family": "quantum" }, { "url": "qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion", "family": "medusa" }, { "url": "medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion", "family": "medusa" }, { "url": "medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion", "family": "medusa" }, { "url": "xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion", "family": "medusa" }, { "url": "kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion", "family": "medusa" }, { "url": "s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion", "family": "medusa" }, { "url": "cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion", "family": "medusa" }, { "url": "62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion", "family": "medusa" }, { "url": "hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion", "family": "snatch" }, { "url": "midasbkic5eyfox4dhnijkzc7v7e4hpmsb2qgux7diqbpna4up4rtdad.onion", "family": "midas" }, { "url": "leaksv7sroztl377bbohzl42i3ddlfsxopcb6355zc7olzigedm5agad.onion", "family": "entropy" }, { "url": "mosesstaffm7hptp.onion", "family": "mosesstaff" }, { "url": "z6mikrtphid5fmn52nbcbg25tj57sowlm3oc25g563yvsfmygkcxqbyd.onion", "family": "cooming" }, { "url": "teo7aj5mfgzxyeme.onion", "family": "cooming" }, { "url": "gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion", "family": "rook" }, { "url": "tdoe2fiiamwkiadhx2a4dfq56ztlqhzl2vckgwmjtoanfaya4kqvvvyd.onion", "family": "unknown" }, { "url": "darktorhvabc652txfc575oendhykqcllb7bh7jhhsjduocdlyzdbmqd.onion", "family": "unknown" }, { "url": "t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion", "family": "rransom" }, { "url": "babydovegkmhbontykziyq7qivwzy33mu4ukqefe4mqpiiwd3wibnjqd.onion", "family": "babyduck" }, { "url": "alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion", "family": "alphv" }, { "url": "2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion", "family": "alphv" }, { "url": "vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion", "family": "alphv" }, { "url": "alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion", "family": "alphv" }, { "url": "7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion", "family": "cryp70n1c0d3" }, { "url": "dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion", "family": "dread" }, { "url": "giphvoitymatg4cv7bxqh5dz6sn6bfscywoat4qtslztkomf5lavrayd.onion", "family": "againstthewest" }, { "url": "matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion", "family": "holyghost" }, { "url": "gg5ryfgogainisskdvh4y373ap3b2mxafcibeh2lvq5x7fx76ygcosad.onion", "family": "nightsky" }, { "url": "u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion", "family": "ransomcartel" }, { "url": "cartelirsn5l54ehcbalyyqtfb3j7be2rpvf6ujayaf5qqmg3vlwiayd.onion", "family": "ransomcartel" }, { "url": "cartelraqonekult2cxbzzz2ukiff7v6cav3w373uuhenybgqulxm5id.onion", "family": "ransomcartel" }, { "url": "adminavf4cikzbv6mbbp7ujpwhygnn2t3egiz2pswldj32krrml42wyd.onion", "family": "adminlocker" }, { "url": "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion", "family": "sugar" }, { "url": "zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion", "family": "zeon" }, { "url": "gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion", "family": "freecivilian" }, { "url": "vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion", "family": "pandora" }, { "url": "3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion", "family": "stormous" }, { "url": "h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion", "family": "stormous" }, { "url": "ransekgbpijp56bflufgxptwn5hej2rztx423v6sim2zrzz7xetnr2qd.onion", "family": "stormous" }, { "url": "pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion", "family": "stormous" }, { "url": "stmxylixiz4atpmkspvhkym4

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Avaddon family
    avaddon
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 45 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /query /fo CSV /v
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4692
    • C:\Windows\SysWOW64\net.exe
      "net" session
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 session
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_LogicalDisk | Where-Object { $_.DriveType -eq 2 -or $_.DriveType -eq 4 -or $_.DriveType -eq 5 } | Select DeviceID,VolumeName,DriveType,Size,FreeSpace | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4640
    • C:\Windows\SysWOW64\reagentc.exe
      "reagentc" /info
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:5132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $sr = Get-ComputerRestorePoint -ErrorAction SilentlyContinue if ($null -eq $sr) { 'NO_RESTORE_POINTS' } else { $sr.Count } } Catch { 'DISABLED_OR_ERROR' } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1124
    • C:\Windows\SysWOW64\sfc.exe
      "sfc" /verifyonly
      2⤵
      • System Location Discovery: System Language Discovery
      PID:880
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-Process | Select Name,Id,Path,@{N='StartTime';E={$_.StartTime.ToString('o')}} -ErrorAction SilentlyContinue | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_Service | Select Name,DisplayName,State,PathName,StartMode | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2288
    • C:\Windows\SysWOW64\auditpol.exe
      "auditpol" /get /category:* /r
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2584
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $st=(Get-Date).AddDays(-7); Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104;StartTime=$st} -MaxEvents 1000 | Select TimeCreated,Message } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2972
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=524} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='VSS';Level=2,3} -MaxEvents 50 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6084
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $histPath = (Get-PSReadlineOption).HistorySavePath if (Test-Path $histPath) { Get-Content $histPath -Tail 1000 | Where-Object { $_ -match 'vssadmin|shadowcopy|wbadmin|bcdedit|diskshadow' } | Select-Object -Last 20 } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5768
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-WmiObject -Class Win32_Service | Where-Object { $_.State -eq 'Stopped' -and $_.StartMode -eq 'Auto' } | Select Name,DisplayName,State,StartMode,PathName | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2148
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-SmbShare | Where-Object { $_.ShareType -eq 'FileSystemDirectory' } | Select Name,Path,Description | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem | Where-Object { $_.DisplayRoot -like '\\*' } | Select Name,DisplayRoot | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:232
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational';Id=21,25} -MaxEvents 20 -ErrorAction SilentlyContinue | Select TimeCreated,@{n='User';e={$_.Properties[0].Value}},@{n='Source';e={$_.Properties[2].Value}} } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Security';Id=5140,5145} -MaxEvents 50 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'ADMIN\$|C\$|IPC\$' } | Select TimeCreated,Message } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $feat = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue if ($feat -and $feat.State -eq 'Enabled') { [PSCustomObject]@{ SMBv1Enabled=$true; State=$feat.State } } } Catch { Try { $cfg = Get-SmbServerConfiguration -ErrorAction SilentlyContinue if ($cfg.EnableSMB1Protocol -eq $true) { [PSCustomObject]@{ SMBv1Enabled=$true; State='EnableSMB1Protocol=True' } } } Catch { @() } } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5416
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue $nla = $rdp.UserAuthentication $enabled = $rdp.fDenyTSConnections if ($enabled -eq 0 -and $nla -ne 1) { [PSCustomObject]@{ RDPEnabled=$true; NLADisabled=$true; NLAValue=$nla } } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $keys = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServices', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce' ) foreach ($key in $keys) { if (Test-Path $key) { Get-ItemProperty $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | Where-Object { $_.Name -notin @('PSPath','PSParentPath','PSChildName','PSProvider','PSDrive') } | ForEach-Object { $val = (Get-ItemProperty $key).$($_.Name) [PSCustomObject]@{ Key = $key Name = $_.Name Value = $val } } } } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5448
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102} -MaxEvents 20 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=104} -MaxEvents 20 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,LogName,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4072
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -ListLog Security,System,Application -ErrorAction SilentlyContinue | Select LogName,RecordCount,FileSize,LastWriteTime } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5316
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Security';Id=4663} -MaxEvents 100 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'lsass' } | Select TimeCreated,Message -First 10 } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3256
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=5805,5723} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=4742} -MaxEvents 30 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Computer Account.*changed|msDS-KeyCredentialLink' } $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5636
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $pref = Get-MpPreference -ErrorAction SilentlyContinue [PSCustomObject]@{ RealTimeMonitoring = $pref.DisableRealtimeMonitoring BehaviorMonitoring = $pref.DisableBehaviorMonitoring IOAVProtection = $pref.DisableIOAVProtection ScriptScanning = $pref.DisableScriptScanning ExclusionPaths = ($pref.ExclusionPath -join '; ') ExclusionExts = ($pref.ExclusionExtension -join '; ') ExclusionProcesses = ($pref.ExclusionProcess -join '; ') } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1588
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-NetFirewallProfile -ErrorAction SilentlyContinue | Select Name,Enabled } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational';Id=5001,5010,5012} -MaxEvents 20 -ErrorAction SilentlyContinue | Select TimeCreated,Id,Message } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3192
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-Process -ErrorAction SilentlyContinue | Select Id,ProcessName,Path } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3836
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Select LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess,State } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3960
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-DnsClientCache -ErrorAction SilentlyContinue | Select Entry,Data } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5772
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='Application';ProviderName='Microsoft-Windows-Diagnostics-Scripted';Id=101,102} -MaxEvents 20 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'msdt\.exe.*PCWDiagnostic|ms-msdt:' } $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3740
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $key = Get-ItemProperty 'HKCR:\ms-msdt' -ErrorAction SilentlyContinue if ($key) { [PSCustomObject]@{ MSDTHandlerExists=$true; URLProtocol=$key.'URL Protocol' } } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $proxy = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -ErrorAction SilentlyContinue if ($proxy.ProxyEnable -eq 1) { [PSCustomObject]@{ ProxyEnabled=$true; ProxyServer=$proxy.ProxyServer } } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2340
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $events = @() $events += Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 50 -ErrorAction SilentlyContinue $events += Get-WinEvent -FilterHashtable @{LogName='Security';Id=4697} -MaxEvents 50 -ErrorAction SilentlyContinue $events | Select TimeCreated,Id,Message | Sort TimeCreated -Descending } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1616
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match 'Temp|AppData|Users\\Public|Downloads' } | Select Name,DisplayName,PathName,State -First 20 } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'ltmdm' } | Select Name,State,PathName } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5292
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $filters = Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction SilentlyContinue | Select Name,Query $consumers = Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -ErrorAction SilentlyContinue | Select Name,CommandLineTemplate,ExecutablePath $bindings = Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue | Select Filter,Consumer $result = @() foreach ($f in $filters) { $result += [PSCustomObject]@{ Type='EventFilter'; Name=$f.Name; Detail=$f.Query } } foreach ($c in $consumers) { $cmd = if ($c.CommandLineTemplate) { $c.CommandLineTemplate } else { $c.ExecutablePath } $result += [PSCustomObject]@{ Type='CommandLineConsumer'; Name=$c.Name; Detail=$cmd } } foreach ($b in $bindings) { $result += [PSCustomObject]@{ Type='Binding'; Name='FilterToConsumer'; Detail=\"$($b.Filter) -> $($b.Consumer)\" } } $result } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4628
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { $svc = Get-Service -Name Spooler -ErrorAction SilentlyContinue [PSCustomObject]@{ Status=$svc.Status.ToString(); StartType=$svc.StartType.ToString() } } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Try { Get-PrinterDriver -ErrorAction SilentlyContinue | Select Name,PrinterEnvironment,InfPath -First 30 } Catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2928
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $disks = Get-PhysicalDisk -ErrorAction Stop $results = @() foreach ($d in $disks) { try { $r = $d | Get-StorageReliabilityCounter -ErrorAction Stop $results += [PSCustomObject]@{ Id = $d.DeviceId Name = $d.FriendlyName Media = [string]$d.MediaType Health = [string]$d.HealthStatus OpStatus = [string]$d.OperationalStatus Temp = $r.Temperature ReadErr = $r.ReadErrorsTotal WriteErr = $r.WriteErrorsTotal ReadErrU = $r.ReadErrorsUncorrected WriteErrU = $r.WriteErrorsUncorrected Wear = $r.Wear POH = $r.PowerOnHours } } catch {} } $results } catch { @() } | ConvertTo-Json -Depth 8"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$auto = @{} try { $val = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name NoDriveTypeAutoRun -ErrorAction Stop).NoDriveTypeAutoRun $auto['NoDriveTypeAutoRun'] = $val } catch { $auto['NoDriveTypeAutoRun'] = -1 } try { $val = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf' -ErrorAction Stop).'(default)' $auto['IniFileMapping'] = $val } catch { $auto['IniFileMapping'] = '' } $drives = @() Get-PSDrive -PSProvider FileSystem -ErrorAction SilentlyContinue | ForEach-Object { $root = $_.Root $inf = Join-Path $root 'autorun.inf' if (Test-Path $inf -ErrorAction SilentlyContinue) { $content = '' try { $content = Get-Content $inf -Raw -ErrorAction Stop -TotalCount 50 } catch {} $drives += [PSCustomObject]@{Drive=$root;Content=$content} } } @{Registry=$auto;AutorunFiles=$drives} | ConvertTo-Json -Depth 8"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { (Get-HotFix -EA Stop | Select-Object -ExpandProperty HotFixID) -join ',' } catch { '' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'SMB1' -ErrorAction Stop).'SMB1'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:4592
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -ErrorAction Stop).'UserAuthentication'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:5916
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { Get-WinEvent -LogName 'System' -MaxEvents 50 -ErrorAction Stop | Where-Object { ($_.Id -eq 5805 -or $_.Id -eq 5723) -and $_.Message -match 'Netlogon' } | Measure-Object | Select-Object -ExpandProperty Count } catch { Write-Output '0' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:5540
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $s = Get-Service -Name 'Spooler' -ErrorAction Stop; if ($s.Status -eq 'Running') { Write-Output 'RUNNING' } else { Write-Output 'STOPPED' } } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:4440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $s = Get-Service -Name 'Spooler' -ErrorAction Stop; if ($s.Status -eq 'Running') { Write-Output 'RUNNING' } else { Write-Output 'STOPPED' } } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2448
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Test-Path 'Registry::HKCR\ms-msdt') { Write-Output 'EXISTS' } else { Write-Output 'MISSING' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:4368
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name 'ClientVersionToReport' -ErrorAction Stop).'ClientVersionToReport'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:1092
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3' -Name '1001' -ErrorAction Stop).'1001'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5360
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Item 'C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx' -ErrorAction SilentlyContinue) { Write-Output 'FOUND' } else { Write-Output 'NONE' }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:3184
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "if (Get-Process -Name 'java' -ErrorAction SilentlyContinue) { Write-Output 'RUNNING' } else { Write-Output 'NONE' }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:1656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'DisableCompression' -ErrorAction Stop).'DisableCompression'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:5488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "try { $v = (Get-ItemProperty -Path 'Registry::HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name 'ClientVersionToReport' -ErrorAction Stop).'ClientVersionToReport'; Write-Output $v } catch { Write-Output 'NOT_FOUND' }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:5812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\Temp\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:2632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Users\*\AppData\Local\Temp\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:6104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\System32\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:5088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\SysWOW64\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:3060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\ProgramData\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:4832
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Users\Public\*.exe' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:4496
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "$f = Get-Item 'C:\Windows\System32\drivers\*.sys' -ErrorAction SilentlyContinue | Select-Object -First 200; foreach ($i in $f) { $sig = Get-AuthenticodeSignature $i.FullName -ErrorAction SilentlyContinue; if ($sig) { $st = $sig.Status.ToString(); $sn = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { 'N/A' }; Write-Output \"$($i.FullName)|$st|$sn|$($i.Length)\"; } }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:660
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $drivers = Get-WmiObject Win32_SystemDriver -ErrorAction SilentlyContinue | Where-Object { $_.State -eq 'Running' -and $_.PathName -ne $null } | Select-Object Name, DisplayName, PathName, State | ConvertTo-Json -Compress if ($drivers) { $drivers } else { '[]' } } catch { '[]' } "
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      PID:5548
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $bcd = bcdedit /enum '{current}' 2>&1 $safeboot = $bcd | Select-String 'safeboot' if ($safeboot) { @{ safeboot_enabled = $true; detail = $safeboot.ToString().Trim() } | ConvertTo-Json -Compress } else { '{}' } } catch { '{}' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:424
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $logs = Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Id -eq 4104 -and $_.Message -notmatch 'ransomnote_finder' } | Select-Object TimeCreated, Message -First 50 $suspicious = @() foreach ($log in $logs) { $msg = $log.Message if ($msg -match '(?i)(encodedcommand|invoke-expression|downloadstring|amsi|mimikatz|iex\s*\()') { $suspicious += @{ time = $log.TimeCreated.ToString('o') snippet = $msg.Substring(0, [Math]::Min(300, $msg.Length)) } } } $suspicious | ConvertTo-Json -Compress } catch { '[]' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:3428
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $rmm_services = 'AnyDesk','TeamViewer','ScreenConnect','Splashtop','AteraAgent','Syncro','Action1','RustDesk','MeshAgent' $found = Get-Service -ErrorAction SilentlyContinue | Where-Object { $svc = $_.Name; $rmm_services | Where-Object { $svc -match $_ } } | Select-Object Name, DisplayName, Status, StartType | ConvertTo-Json -Compress if ($found) { $found } else { '[]' } } catch { '[]' } "
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:4544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $recent = Get-ChildItem 'C:\Users' -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-72) } | Group-Object Extension -NoElement | Sort-Object Count -Descending | Select-Object Count, Name -First 10 | ConvertTo-Json -Compress if ($recent) { $recent } else { '[]' } } catch { '[]' } "
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:5688
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $bcd = bcdedit /enum '{current}' 2>&1 | Out-String $result = @{ raw = $bcd } if ($bcd -match 'safeboot') { $result['safeboot_found'] = $true $match = [regex]::Match($bcd, 'safeboot\s+(\S+)') if ($match.Success) { $result['safeboot_value'] = $match.Groups[1].Value } } # Check default boot entry $default = bcdedit /enum '{default}' 2>&1 | Out-String if ($default -match 'safeboot') { $result['default_safeboot'] = $true } $result | ConvertTo-Json -Compress } catch { '{}' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:4716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $safeMinimal = 'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal' $unusual = @() if (Test-Path $safeMinimal) { $keys = Get-ChildItem $safeMinimal -ErrorAction SilentlyContinue foreach ($key in $keys) { $name = $key.PSChildName # Blacklist approach: entry is legitimate if it matches ANY of: # 1. Device class GUID ({xxxxxxxx-...}) # 2. Registered Windows service # 3. Known OS component (drivers, core services) $isLegit = $false # GUIDs are always device class identifiers (legitimate) if ($name -match '^\{') { $isLegit = $true } # Known Windows core SafeBoot entries (comprehensive list) if (-not $isLegit) { $knownOS = @('Ahcache.sys','AppInfo','AppXSvc','Base', 'BasicDisplay.sys','BasicRender.sys','Boot Bus Extender', 'Boot File System','cdd.dll','CoreMessagingRegistrar', 'CryptSvc','DcomLaunch','DeviceInstall','DeviceSetupManager', 'dxgkrnl.sys','EFS','EventLog','File system','Filter', 'FilterManager','FontCache','FsDepends','FsDepends.sys', 'HdAudAddService.Sys','HdAudBus.sys','HelpSvc','HidSpiCx.sys', 'Kernel','KeyIso','LSM','luafv.sys', 'Netlogon','netprofm','NetworkListSvc','NetworkProvider', 'nsi','NTDS','PCI Configuration','PNP Filter','PNP_STATUS', 'Power','Primary disk','ProfSvc', 'RpcEptMapper','rpcss','RpcSs','sacsvr','SamSs','SCardSvr', 'SCSI Class','SecurityProviders','SerCx2.sys','sermouse.sys', 'ServiceModelEndpoint 4.0.0.0','ShellHWDetection','SpbCx.sys', 'sppsvc','StateRepository','StorSvc','System Bus Extender', 'SystemEventsBroker','TBS','TDI','TimeBrokerSvc','TrustedInstaller', 'uefi.sys','UGTHRSVC','usbaudio.sys','usbaudio2.sys', 'USBHUB3.sys','USBXHCI.sys','UserManager','VDS','VGA', 'vmms','volmgr.sys','volmgrx.sys','volsnap.sys', 'VSS','W32Time','WarpJITSvc','Wdf01000','Wdf01000.sys', 'WinDefend','WinMgmt','Winmgmt','WudfPf','WudfRd', 'AudioEndpointBuilder','AudioSrv','BFE','BITS', 'BrokerInfrastructure','CoreUI','DsSvc','EventSystem', 'gpsvc','IKEEXT','iphlpsvc','LanmanServer', 'LanmanWorkstation','MpsSvc','NcbService','Ndisuio.sys', 'NlaSvc','nsiproxy.sys','PolicyAgent','Schedule','SENS', 'Themes','TokenBroker','UmPass.sys','Wcmsvc', 'WinHttpAutoProxySvc','Winmgmt','WlanSvc','WPDBusEnum', 'wuauserv','WwanSvc','disk.sys','partmgr.sys','fvevol.sys', 'rdyboost.sys','mup.sys','iorate.sys','intelpep.sys', 'WindowsTrustedRT','WindowsTrustedRTProxy', 'storahci.sys','stornvme.sys','EhStorClass.sys', 'vmbus.sys','hyperkbd.sys','dmvsc.sys','vmbkmcl.sys') if ($knownOS -contains $name) { $isLegit = $true } } # Fallback: check if it's a registered service if (-not $isLegit) { $svc = Get-Service -Name $name -ErrorAction SilentlyContinue if ($svc) { $isLegit = $true } } if (-not $isLegit) { $unusual += @{ name = $name; path = $key.Name } } } } $unusual | ConvertTo-Json -Compress } catch { '[]' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Network Service Discovery
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:760
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $pending = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'BootExecute' -ErrorAction SilentlyContinue $reboot = @{} if ($pending -and $pending.BootExecute -match 'safeboot') { $reboot['pending_safeboot'] = $true } $reboot | ConvertTo-Json -Compress } catch { '{}' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      PID:4360
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $shadows = vssadmin list shadows 2>&1 | Out-String if ($shadows -match 'Shadow Copy Volume') { $count = ([regex]::Matches($shadows, 'Shadow Copy ID')).Count @{ available = $true; count = $count } | ConvertTo-Json -Compress } else { @{ available = $false; count = 0 } | ConvertTo-Json -Compress } } catch { @{ available = $false; count = 0 } | ConvertTo-Json -Compress } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      PID:5616
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command " try { $result = @{} # RDP enabled check $rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -ErrorAction SilentlyContinue $result['rdp_enabled'] = ($rdp.fDenyTSConnections -eq 0) # NLA (Network Level Authentication) for RDP $nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -ErrorAction SilentlyContinue $result['nla_enabled'] = ($nla.UserAuthentication -eq 1) # SMBv1 check $smb1 = Get-SmbServerConfiguration -ErrorAction SilentlyContinue | Select-Object EnableSMB1Protocol if ($smb1) { $result['smbv1_enabled'] = $smb1.EnableSMB1Protocol } # Guest account $guest = Get-LocalUser -Name 'Guest' -ErrorAction SilentlyContinue if ($guest) { $result['guest_enabled'] = $guest.Enabled } # Windows Update - last install date $hotfix = Get-HotFix -ErrorAction SilentlyContinue | Sort-Object InstalledOn -Descending | Select-Object -First 1 if ($hotfix -and $hotfix.InstalledOn) { $result['last_patch'] = $hotfix.InstalledOn.ToString('yyyy-MM-dd') $days = ((Get-Date) - $hotfix.InstalledOn).Days $result['patch_age_days'] = $days } # Firewall status $fw = Get-NetFirewallProfile -ErrorAction SilentlyContinue | Select-Object Name, Enabled $result['firewall_profiles'] = ($fw | Where-Object { $_.Enabled } | ForEach-Object { $_.Name }) -join ',' # Admin shares $shares = Get-SmbShare -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '^\w\$|^ADMIN\$|^IPC\$' } $result['admin_shares'] = $shares.Count $result | ConvertTo-Json -Compress } catch { '{}' } "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Hide Artifacts: Ignore Process Interrupts
      PID:2200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        • Size 1KB
        • SHA256 73316c4c39ce34c44aa26ba504def77616d56f1d7e4a4330ce67a3719ba7b7b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 91609af1ae7afa21db10b2a77cd555063248f43ececc98c2a1f5c6e59afa1f55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 32de5ecf0a07b0829e742545970cf02514be49dd4d8c1a420c6beca968833c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 073d9ebb8b1b7084834ef04f4e653060619d6ab7b115cb70b73308d1ec52ac17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 8d7627ece5360132dba71f1c83a4610a898d32a264b1ce0d3f74a105abda55ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 eab49863f6698a5c220496fdda961372594a18c01d390c394df81e9dc47c989c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 125bdff6ee8b385d059cadff153d965e54c325125b6d7fd2b3212dcae30bd4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 21KB
        • SHA256 a6f9a69b805cf9bb5d32cec89e012fa5a3b4d1d6e0f24b799acbb77319989705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 86c3d11e92093898605ae981da0ffbcd9be67a7816a0cdb66922ecb1f75dcfe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 881be560d8482d2d657e1514c06ac7d95d793b368ad9e4b44f08e259ba4c4de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 e2cc5c2c65fec74ed3b4783e54d53d3fa1b5ca28ef4c536295df14d556a02068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 1c6a527c6a479a02344e04eb731f0d10a7bf8d6ad9ec86b85daafe1f92808bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 c7bb50f3ff165dd36437b2d30a85a0bff2f7867a08509ded5077a191162ad2b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 a89b54db0b8203961d4a324d3b4af1bfb690c1e7d86e970fa9345d8013e3ca56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 1c25ee965a93a486ba4c34c51b727762bad6a0ace06c102d0698f45f89e51305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 1dc45e08a9d884ef7a07a3a133cb4849dc6631dedfc5110aa5cbac2a759b1d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 70977b2dadbc9b86c7acdbff25dc2d9f95697808c7cfcdee826e4d98aed593ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 b02c712fa0540eca97e09c593da1b72fadda3d26d6414813feea23528a659537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 30047dfa3a5e34ea3cf7e7ff362cb25a1b601d1a44f3e60993be715d3e55a783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 3d863404a2fc06f7cf756a1b29d41a92489c4186ae3ddec479ff83042d7c4fdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 49285bb72ecafd5107a359ce404e3fcc5f9d24c0136035d5a260821cf9af2c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 17bd60dad3af9df6438fa4620c658f3c513ca3a2378cf689bb2b2bbc24a5e5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 072b453f694d24508b2f4dd203730646a964e03e9a1f606116b847a712d74671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 e6aaa060bf2bf07cd0cf2efad77ec483bb24533041125d12defc7e959f381fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 240c6520080b3b6d0550bb251c92ff8d2071ec310bb6db24a8329f380fcca2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 48ded83296b26c53ee12ce2de1b725d12bd0336fcffd9d6d2849e97d51584d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 58b5e10febf25c282e5392853a6bed60aa0b16df095c1f1d5276a2ef9e800370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 58f0c7c896e9a94c0647f96b0dcb3de2f28d8df044d3085aea258dae70985bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 cebad204b5a7049e0f316cff53b387254a2c0b6eae04c6031f96fce0e94be651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 e5acf836e4ef98cdf19c55fcf70d82d6589c26ade4c43ba8571a91be935a5f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 37adafb724fbf244f803bb14062a5eb05a91f09099c1174a94497f67342237a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 41a11c9c222304d4c4e66af9474d271f4b1508e51cbaf5038f2f4d653727434c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 bfa79d750754e49cfc3ff427429e763a23b9e1941defb5f124a9affb729ff296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 15KB
        • SHA256 794b19c9bbb22eedb62195531185d07bc62bb120047ccb7b0f6d2e4984be5067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 19KB
        • SHA256 725dfd07a0084bae6bda009be5aa6116833a8595e3a8ac100f5d4ccade29a6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 10e4199807a1b76cf0a6eb922d139887b95ab74d96876380571d036349bc16ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 81919e4d393af3151856ada0a9b42925af197d5ecd9a46df7225bdd1abe7a6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 ffaeb14a76fb904f05675aa67975eebc9a1631c70d53dc29d6366e5e6c19bb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 882c63328d15aa44b29f427dcc31b5638897a2aaa3175e5817582d89a64a5cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 f4e8b76fc6d705281f79fd2d60f47acec0a2bd1a6df0c4ffce4ec616c115046f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 92d61b84e40bcb4a273efc977a67ffdacb3026cf3e8ef7fa3bc5cb005a08b216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 e174d51a659151ffae3b8bf52ef94c9e0e46a3cd335b35add83a71151b61c154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 f9f7f129a87ced21d167054b5784fc21592debb4c2ae1c84dbc7c368ef1f5258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 ef1d8210d563d2d46469903ccb5b36c8cefaee60ee7da98c91da066a9c84d0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 b977a202b74e325217f21067a578e71c9be78b50693a5d6cf34b27bc7685e3a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 1185a74144399b0ae3a2af3f3917f178f2e5c5409d619a8263d21b65ac359349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 e2ee91b3d1d3c5ec0551a68701d600df21530ae5396c563e4abaab22b2f0af9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 5cdcc1676687dc39f5f1c4a1c434eabc162dd692ecf069d77873a545b597311a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 5355fcce7155c5a08715fddc653c676bc81cc6754c77c12a732c3d85905488b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 53e68b2ee39adf13fedc810ea22a6c7bb60c0cd07127a87cbd780ea55096f858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 5702cfc4d290c7267b9442b4215a27b7340442543b4378afbef6b934aac06506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 129186e82764844d688716f03f7fb24474a5c18931d473bdad1212cf0e10654a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 b66c13d680dd771617dc9c7278e3af37d17749181eb134070b79f07c18b8f552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 79857827183698f7af33843867303aab05ece44e15bd54432038ccb411837f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 16KB
        • SHA256 c354e80dc6fc953d99ffecd5b24fa9a86a062cf969a47671776b9c3c683f67c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 ab096d7576a9e639ac8e2d6decee98c1a4415c98d43f6bb5e8b80e329c2bc2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 cfce39cfc05f6e810ba112eba458fbb6069500f49277a6910d0cafa0b893632e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 75ad3b31cd197af39c459d713486a33bb7b296c7c8ef61ca660de810fb3cad0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 428a9063ba28ce32a57ab4ea95e917b0b2a9db28e909f527b548419b7f3d8ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 c05b8f8b797010088bfc5c85d54a305be85659372336ff248d78faf1be93c3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 17KB
        • SHA256 305617021bca04ff6aa0f65d8090bf061c68f0ccc9a3f2ce19716a600091fd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 18KB
        • SHA256 5ce25c741adc139f9ab57eda596f2a695e2026553f3e9ba6945b9e0361515598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_p355llno.tob.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p355llno.tob.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        c2_ips.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\c2_ips.json
        • Size 47KB
        • SHA256 ebfcb9c94bf06f15f4990eeb6feeb292b1c89143ef6949b0f758460894c2439d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cve_rules.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\cve_rules.json
        • Size 173KB
        • SHA256 c9f86e5cac6e2a1a71f9bbb9ddacfb3c86fb7573956e522e104b7d28459b543f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extensions.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\extensions.json
        • Size 2KB
        • SHA256 eb780fbeb4863ddc19b16eabd4b95d9b2477a1f41859f1a19c74f247a3429dde
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        feed_meta.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\feed_meta.json
        • Size 594B
        • SHA256 33368551aa34a4b664363b5e1d068a5b0f6b120e7107c52734934d87c1ba8c16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        known_onion_urls.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\known_onion_urls.json
        • Size 48KB
        • SHA256 fb10cf713ce84760beeb909a81b207805035fd488c91923bce1cdeb31e79cec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        known_wallets.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\known_wallets.json
        • Size 2KB
        • SHA256 a564298542fba156c68847f4407a07f56d988b85c36ffc4467ad9f1413f4bb23
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ransom_filenames.json
        • Path C:\Users\Admin\AppData\Local\Temp\signatures\ransom_filenames.json
        • Size 2B
        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
        • MD5 SHA1 SHA512
        Submit Download

        ReAgent.log
        • Path C:\Windows\Logs\ReAgent\ReAgent.log
        • Size 3KB
        • SHA256 2a53b007b5ad1a3a6bbd7b8ad86196508e82ca28d4d0500da78286282b7c1fea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/232-179-0x00000000079A0000-0x00000000079EA000-memory.dmp
        Download

        memory/424-640-0x0000000007C20000-0x0000000007C3A000-memory.dmp
        Download

        memory/424-641-0x0000000007C40000-0x0000000007C48000-memory.dmp
        Download

        memory/424-639-0x0000000007B30000-0x0000000007B45000-memory.dmp
        Download

        memory/424-632-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/660-588-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/1124-62-0x0000000005360000-0x000000000537F000-memory.dmp
        Download

        memory/1124-61-0x0000000005290000-0x000000000529E000-memory.dmp
        Download

        memory/1124-60-0x00000000051A0000-0x000000000528A000-memory.dmp
        Download

        memory/1460-398-0x00000000079C0000-0x00000000079E4000-memory.dmp
        Download

        memory/1460-399-0x00000000079A0000-0x00000000079A8000-memory.dmp
        Download

        memory/1588-253-0x0000000005D90000-0x00000000060E7000-memory.dmp
        Download

        memory/2148-145-0x0000000005970000-0x0000000005CC7000-memory.dmp
        Download

        memory/2148-148-0x0000000007360000-0x0000000007384000-memory.dmp
        Download

        memory/2148-149-0x0000000007330000-0x0000000007338000-memory.dmp
        Download

        memory/2200-723-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/2288-110-0x00000000070B0000-0x00000000070D4000-memory.dmp
        Download

        memory/2288-107-0x0000000005820000-0x0000000005B77000-memory.dmp
        Download

        memory/2288-111-0x0000000007090000-0x0000000007098000-memory.dmp
        Download

        memory/2828-92-0x00000000062B0000-0x0000000006607000-memory.dmp
        Download

        memory/2828-99-0x0000000006870000-0x00000000068BC000-memory.dmp
        Download

        memory/2972-118-0x0000000005E20000-0x0000000006177000-memory.dmp
        Download

        memory/3060-557-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/3428-650-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/4496-156-0x0000000006010000-0x0000000006367000-memory.dmp
        Download

        memory/4496-167-0x0000000007800000-0x00000000078A4000-memory.dmp
        Download

        memory/4496-166-0x0000000006AE0000-0x0000000006AFE000-memory.dmp
        Download

        memory/4496-159-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/4496-158-0x0000000006AA0000-0x0000000006AD4000-memory.dmp
        Download

        memory/4496-168-0x0000000007900000-0x000000000790A000-memory.dmp
        Download

        memory/4496-169-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
        Download

        memory/4496-170-0x0000000007C20000-0x0000000007C2E000-memory.dmp
        Download

        memory/4640-73-0x0000000005F40000-0x000000000602A000-memory.dmp
        Download

        memory/4640-66-0x0000000005F40000-0x000000000602A000-memory.dmp
        Download

        memory/4640-12-0x00000000052A0000-0x00000000052D6000-memory.dmp
        Download

        memory/4640-14-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
        Download

        memory/4640-15-0x0000000005910000-0x0000000005F3A000-memory.dmp
        Download

        memory/4640-17-0x0000000005830000-0x0000000005852000-memory.dmp
        Download

        memory/4640-75-0x00000000057E0000-0x00000000057FF000-memory.dmp
        Download

        memory/4640-65-0x0000000009650000-0x0000000009B7C000-memory.dmp
        Download

        memory/4640-19-0x00000000060A0000-0x0000000006106000-memory.dmp
        Download

        memory/4640-67-0x0000000005860000-0x000000000586E000-memory.dmp
        Download

        memory/4640-18-0x0000000006030000-0x0000000006096000-memory.dmp
        Download

        memory/4640-68-0x00000000057E0000-0x00000000057FF000-memory.dmp
        Download

        memory/4640-20-0x0000000006290000-0x00000000065E7000-memory.dmp
        Download

        memory/4640-33-0x0000000006800000-0x000000000681E000-memory.dmp
        Download

        memory/4640-34-0x0000000006890000-0x00000000068DC000-memory.dmp
        Download

        memory/4640-55-0x0000000006DC0000-0x0000000006DE2000-memory.dmp
        Download

        memory/4640-54-0x0000000006D40000-0x0000000006D5A000-memory.dmp
        Download

        memory/4640-53-0x0000000007820000-0x00000000078B6000-memory.dmp
        Download

        memory/4640-56-0x0000000007E70000-0x0000000008416000-memory.dmp
        Download

        memory/4640-70-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
        Download

        memory/4640-13-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
        Download

        memory/4640-69-0x0000000002ED0000-0x0000000002EE0000-memory.dmp
        Download

        memory/4640-57-0x0000000008AA0000-0x000000000911A000-memory.dmp
        Download

        memory/4640-64-0x00000000085F0000-0x00000000087B2000-memory.dmp
        Download

        memory/4716-681-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/5088-542-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/5540-424-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/5548-624-0x00000000072D0000-0x00000000072D8000-memory.dmp
        Download

        memory/5548-623-0x00000000073E0000-0x0000000007404000-memory.dmp
        Download

        memory/5548-615-0x0000000005A10000-0x0000000005D67000-memory.dmp
        Download

        memory/5616-709-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download

        memory/5768-136-0x00000000059E0000-0x0000000005D37000-memory.dmp
        Download

        memory/5916-413-0x00000000059B0000-0x0000000005D07000-memory.dmp
        Download

        memory/6084-127-0x0000000005D80000-0x00000000060D7000-memory.dmp
        Download

        memory/6104-527-0x00000000711F0000-0x000000007123C000-memory.dmp
        Download