bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe

Analysis

max time kernel
149s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe
Size 58.0MB
Sample260420-rseq6ac14q
SHA256 bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe
MD5 1001ebdcfa03343a271e33d2770260ac
SHA1 b0b13016df43d80a189c4e616a65607129c7c7cf
SHA512 398e4f3f91a4c56fd0d37dcb72d38fad1505afa953bde01eac16eb4ff364aa07a046bfc5ce27ac798847023300597783d0a72b79dfbefed70ef4d2b9147f2ac0
SSDEEP 1572864:UqwtPTmM7jiymeL/fWPFx0bWCZZUAD/IEjBwv4YydwmR:QtPSMC+3WPFx0bIOI983R
TLSH
T1A5D7333F728B613AD2BD4A3679FBD221883BBA255106885B57F4C90CCF151B11E3E61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3656	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
1460	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
3876	EApp.exe
4172	EApp.exe
764	EApp.exe

Loads dropped DLL 5 IoCs

pid	Process
3876	EApp.exe
4172	EApp.exe
4172	EApp.exe
4172	EApp.exe
764	EApp.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3084	powershell.exe
3424	powershell.exe
4412	powershell.exe
4904	powershell.exe
5492	powershell.exe
2412	powershell.exe
4236	powershell.exe
4028	powershell.exe
4828	powershell.exe
2860	powershell.exe
5736	powershell.exe
4712	powershell.exe
4796	powershell.exe
4724	powershell.exe
3856	powershell.exe
1600	powershell.exe
1360	powershell.exe
2796	powershell.exe
4940	powershell.exe
3184	powershell.exe
5172	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1328-0-0x0000000000840000-0x0000000000924000-memory.dmp	innosetup
behavioral2/memory/4240-8-0x0000000000840000-0x0000000000924000-memory.dmp	innosetup
behavioral2/memory/1328-11-0x0000000000840000-0x0000000000924000-memory.dmp	innosetup
behavioral2/memory/4240-222-0x0000000000840000-0x0000000000924000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1460	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
1460	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
2796	powershell.exe
2796	powershell.exe
764	EApp.exe
764	EApp.exe
5172	powershell.exe
5172	powershell.exe
3084	powershell.exe
3084	powershell.exe
4028	powershell.exe
3424	powershell.exe
4412	powershell.exe
3424	powershell.exe
4028	powershell.exe
4412	powershell.exe
2412	powershell.exe
4904	powershell.exe
5492	powershell.exe
3184	powershell.exe
4828	powershell.exe
3856	powershell.exe
3856	powershell.exe
2412	powershell.exe
2412	powershell.exe
3856	powershell.exe
4904	powershell.exe
4904	powershell.exe
3184	powershell.exe
3184	powershell.exe
5492	powershell.exe
5492	powershell.exe
4828	powershell.exe
4828	powershell.exe
1360	powershell.exe
4796	powershell.exe
5736	powershell.exe
2860	powershell.exe
1600	powershell.exe
4712	powershell.exe
4712	powershell.exe
4236	powershell.exe
4236	powershell.exe
1360	powershell.exe
1360	powershell.exe
2860	powershell.exe
2860	powershell.exe
4796	powershell.exe
4796	powershell.exe
1600	powershell.exe
1600	powershell.exe
5736	powershell.exe
5736	powershell.exe
4236	powershell.exe
4712	powershell.exe
3876	EApp.exe
3876	EApp.exe
3876	EApp.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeIncreaseQuotaPrivilege	2796	powershell.exe
Token: SeSecurityPrivilege	2796	powershell.exe
Token: SeTakeOwnershipPrivilege	2796	powershell.exe
Token: SeLoadDriverPrivilege	2796	powershell.exe
Token: SeSystemProfilePrivilege	2796	powershell.exe
Token: SeSystemtimePrivilege	2796	powershell.exe
Token: SeProfSingleProcessPrivilege	2796	powershell.exe
Token: SeIncBasePriorityPrivilege	2796	powershell.exe
Token: SeCreatePagefilePrivilege	2796	powershell.exe
Token: SeBackupPrivilege	2796	powershell.exe
Token: SeRestorePrivilege	2796	powershell.exe
Token: SeShutdownPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeSystemEnvironmentPrivilege	2796	powershell.exe
Token: SeRemoteShutdownPrivilege	2796	powershell.exe
Token: SeUndockPrivilege	2796	powershell.exe
Token: SeManageVolumePrivilege	2796	powershell.exe
Token: 33	2796	powershell.exe
Token: 34	2796	powershell.exe
Token: 35	2796	powershell.exe
Token: 36	2796	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe
Token: SeManageVolumePrivilege	5172	powershell.exe
Token: 33	5172	powershell.exe
Token: 34	5172	powershell.exe
Token: 35	5172	powershell.exe
Token: 36	5172	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeIncreaseQuotaPrivilege	3084	powershell.exe
Token: SeSecurityPrivilege	3084	powershell.exe
Token: SeTakeOwnershipPrivilege	3084	powershell.exe
Token: SeLoadDriverPrivilege	3084	powershell.exe
Token: SeSystemProfilePrivilege	3084	powershell.exe
Token: SeSystemtimePrivilege	3084	powershell.exe
Token: SeProfSingleProcessPrivilege	3084	powershell.exe
Token: SeIncBasePriorityPrivilege	3084	powershell.exe
Token: SeCreatePagefilePrivilege	3084	powershell.exe
Token: SeBackupPrivilege	3084	powershell.exe
Token: SeRestorePrivilege	3084	powershell.exe
Token: SeShutdownPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeSystemEnvironmentPrivilege	3084	powershell.exe
Token: SeRemoteShutdownPrivilege	3084	powershell.exe
Token: SeUndockPrivilege	3084	powershell.exe
Token: SeManageVolumePrivilege	3084	powershell.exe
Token: 33	3084	powershell.exe
Token: 34	3084	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 3656	1328	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe	79
PID 3656 wrote to memory of 4240	3656	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp	80
PID 4240 wrote to memory of 1460	4240	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe	81
PID 1460 wrote to memory of 3876	1460	_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp	82
PID 3876 wrote to memory of 6056	3876	EApp.exe	83
PID 6056 wrote to memory of 3196	6056	cmd.exe	85
PID 3876 wrote to memory of 2796	3876	EApp.exe	86
PID 3876 wrote to memory of 4172	3876	EApp.exe	88
PID 3876 wrote to memory of 4172	3876	EApp.exe	88
PID 3876 wrote to memory of 764	3876	EApp.exe	89
PID 3876 wrote to memory of 5172	3876	EApp.exe	92
PID 3876 wrote to memory of 3084	3876	EApp.exe	95
PID 3876 wrote to memory of 1440	3876	EApp.exe	97
PID 3876 wrote to memory of 3424	3876	EApp.exe	99
PID 3876 wrote to memory of 4412	3876	EApp.exe	100
PID 3876 wrote to memory of 4028	3876	EApp.exe	101
PID 3876 wrote to memory of 5632	3876	EApp.exe	105
PID 5632 wrote to memory of 5280	5632	cmd.exe	107
PID 3876 wrote to memory of 2412	3876	EApp.exe	108
PID 3876 wrote to memory of 3184	3876	EApp.exe	109
PID 3876 wrote to memory of 5492	3876	EApp.exe	110
PID 3876 wrote to memory of 3856	3876	EApp.exe	112
PID 3876 wrote to memory of 4828	3876	EApp.exe	114
PID 3876 wrote to memory of 4904	3876	EApp.exe	115
PID 3876 wrote to memory of 4940	3876	EApp.exe	116
PID 3876 wrote to memory of 2860	3876	EApp.exe	122
PID 3876 wrote to memory of 5736	3876	EApp.exe	123
PID 3876 wrote to memory of 1600	3876	EApp.exe	124
PID 3876 wrote to memory of 1360	3876	EApp.exe	125
PID 3876 wrote to memory of 4236	3876	EApp.exe	126
PID 3876 wrote to memory of 4712	3876	EApp.exe	127
PID 3876 wrote to memory of 4796	3876	EApp.exe	128
PID 3876 wrote to memory of 4724	3876	EApp.exe	136

C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe
"C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\is-BQOAAJNMPU.tmp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BQOAAJNMPU.tmp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp" /SL5="$4017C,59602339,874496,C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe
    "C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe" /SILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\is-GYSWRMS674.tmp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GYSWRMS674.tmp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.tmp" /SL5="$5017C,59602339,874496,C:\Users\Admin\AppData\Local\Temp\_bacc2455cc75ea56bc072c7142c8f3fbc7bd52355bcfde15f7fae3b7d960b1fe.exe" /SILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:3196
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe" --type=gpu-process --field-trial-handle=1508,12303260870656822301,17070525274169969858,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1516 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-CB5JTPMAYG.tmp\InDataElectron\EApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,12303260870656822301,17070525274169969858,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1816 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:764
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        6⤵
        
        PID:1440
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3424
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4412
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5632
        
        C:\Windows\system32\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        7⤵
        
        PID:5280
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2412
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3184
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5492
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3856
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4828
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4940
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5736
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1600
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1360
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4236
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4712
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4796
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...