d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe
Size 57.7MB
Sample260505-msad8agy6k
SHA256 d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd
MD5 a0e991486425f9fb2d0a6d0aade54d22
SHA1 81f12c50416fb1efa6b9a6f79588485e7d4a62b2
SHA512 c820ab6bc599d97aa81b8e6d850fe3fc7bd05e800c10a2a7ea0f1948126b76243154cf54db361db976629d1148df819b6c7bd7b6e55861f9b9ec20098d04a4d5
SSDEEP 1572864:mCtbiktgm3mKsZzMOqH/e9K1qrrwHHA4+64OB05rtO:d1tgm3mlzM+qqrrwHHj4OwrU
TLSH
T150D7333B764B653ED4FE9A3B77B2D604753FAE50A9168D8696D0D40CDF010302B2EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2504	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
3220	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
4968	EApp.exe
1740	EApp.exe
1436	EApp.exe

Loads dropped DLL 5 IoCs

pid	Process
4968	EApp.exe
1740	EApp.exe
1740	EApp.exe
1740	EApp.exe
1436	EApp.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2676	powershell.exe
4708	powershell.exe
1168	powershell.exe
892	powershell.exe
3680	powershell.exe
3036	powershell.exe
4120	powershell.exe
3128	powershell.exe
2356	powershell.exe
860	powershell.exe
3344	powershell.exe
2896	powershell.exe
2968	powershell.exe
2332	powershell.exe
708	powershell.exe
4984	powershell.exe
4932	powershell.exe
3452	powershell.exe
1704	powershell.exe
692	powershell.exe
3344	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4712-0-0x0000000000970000-0x0000000000A76000-memory.dmp	innosetup
behavioral2/memory/3232-7-0x0000000000970000-0x0000000000A76000-memory.dmp	innosetup
behavioral2/memory/4712-10-0x0000000000970000-0x0000000000A76000-memory.dmp	innosetup
behavioral2/memory/3232-234-0x0000000000970000-0x0000000000A76000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
3220	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
3220	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
4120	powershell.exe
4120	powershell.exe
1436	EApp.exe
1436	EApp.exe
2676	powershell.exe
2676	powershell.exe
2968	powershell.exe
2896	powershell.exe
3128	powershell.exe
2968	powershell.exe
2896	powershell.exe
3128	powershell.exe
4708	powershell.exe
4984	powershell.exe
860	powershell.exe
2356	powershell.exe
4932	powershell.exe
1168	powershell.exe
892	powershell.exe
4708	powershell.exe
4708	powershell.exe
4984	powershell.exe
4984	powershell.exe
1168	powershell.exe
1168	powershell.exe
2356	powershell.exe
2356	powershell.exe
860	powershell.exe
860	powershell.exe
4932	powershell.exe
4932	powershell.exe
892	powershell.exe
892	powershell.exe
708	powershell.exe
692	powershell.exe
3680	powershell.exe
2332	powershell.exe
3036	powershell.exe
1704	powershell.exe
1704	powershell.exe
3452	powershell.exe
3452	powershell.exe
3452	powershell.exe
708	powershell.exe
708	powershell.exe
3680	powershell.exe
3680	powershell.exe
692	powershell.exe
692	powershell.exe
2332	powershell.exe
2332	powershell.exe
3036	powershell.exe
3036	powershell.exe
1704	powershell.exe
4968	EApp.exe
4968	EApp.exe
4968	EApp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeIncreaseQuotaPrivilege	4120	powershell.exe
Token: SeSecurityPrivilege	4120	powershell.exe
Token: SeTakeOwnershipPrivilege	4120	powershell.exe
Token: SeLoadDriverPrivilege	4120	powershell.exe
Token: SeSystemProfilePrivilege	4120	powershell.exe
Token: SeSystemtimePrivilege	4120	powershell.exe
Token: SeProfSingleProcessPrivilege	4120	powershell.exe
Token: SeIncBasePriorityPrivilege	4120	powershell.exe
Token: SeCreatePagefilePrivilege	4120	powershell.exe
Token: SeBackupPrivilege	4120	powershell.exe
Token: SeRestorePrivilege	4120	powershell.exe
Token: SeShutdownPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeSystemEnvironmentPrivilege	4120	powershell.exe
Token: SeRemoteShutdownPrivilege	4120	powershell.exe
Token: SeUndockPrivilege	4120	powershell.exe
Token: SeManageVolumePrivilege	4120	powershell.exe
Token: 33	4120	powershell.exe
Token: 34	4120	powershell.exe
Token: 35	4120	powershell.exe
Token: 36	4120	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeIncreaseQuotaPrivilege	2676	powershell.exe
Token: SeSecurityPrivilege	2676	powershell.exe
Token: SeTakeOwnershipPrivilege	2676	powershell.exe
Token: SeLoadDriverPrivilege	2676	powershell.exe
Token: SeSystemProfilePrivilege	2676	powershell.exe
Token: SeSystemtimePrivilege	2676	powershell.exe
Token: SeProfSingleProcessPrivilege	2676	powershell.exe
Token: SeIncBasePriorityPrivilege	2676	powershell.exe
Token: SeCreatePagefilePrivilege	2676	powershell.exe
Token: SeBackupPrivilege	2676	powershell.exe
Token: SeRestorePrivilege	2676	powershell.exe
Token: SeShutdownPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeSystemEnvironmentPrivilege	2676	powershell.exe
Token: SeRemoteShutdownPrivilege	2676	powershell.exe
Token: SeUndockPrivilege	2676	powershell.exe
Token: SeManageVolumePrivilege	2676	powershell.exe
Token: 33	2676	powershell.exe
Token: 34	2676	powershell.exe
Token: 35	2676	powershell.exe
Token: 36	2676	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeIncreaseQuotaPrivilege	2896	powershell.exe
Token: SeSecurityPrivilege	2896	powershell.exe
Token: SeTakeOwnershipPrivilege	2896	powershell.exe
Token: SeLoadDriverPrivilege	2896	powershell.exe
Token: SeSystemProfilePrivilege	2896	powershell.exe
Token: SeSystemtimePrivilege	2896	powershell.exe
Token: SeProfSingleProcessPrivilege	2896	powershell.exe
Token: SeIncBasePriorityPrivilege	2896	powershell.exe
Token: SeCreatePagefilePrivilege	2896	powershell.exe
Token: SeBackupPrivilege	2896	powershell.exe
Token: SeRestorePrivilege	2896	powershell.exe
Token: SeShutdownPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeSystemEnvironmentPrivilege	2896	powershell.exe
Token: SeRemoteShutdownPrivilege	2896	powershell.exe
Token: SeUndockPrivilege	2896	powershell.exe
Token: SeManageVolumePrivilege	2896	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3220	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2504	4712	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe	80
PID 2504 wrote to memory of 3232	2504	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp	81
PID 3232 wrote to memory of 3220	3232	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe	82
PID 3220 wrote to memory of 4968	3220	_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp	83
PID 4968 wrote to memory of 3620	4968	EApp.exe	84
PID 3620 wrote to memory of 1496	3620	cmd.exe	86
PID 4968 wrote to memory of 4120	4968	EApp.exe	87
PID 4968 wrote to memory of 1740	4968	EApp.exe	89
PID 4968 wrote to memory of 1740	4968	EApp.exe	89
PID 4968 wrote to memory of 1436	4968	EApp.exe	90
PID 4968 wrote to memory of 2676	4968	EApp.exe	93
PID 4968 wrote to memory of 3344	4968	EApp.exe	96
PID 4968 wrote to memory of 4724	4968	EApp.exe	98
PID 4968 wrote to memory of 2896	4968	EApp.exe	100
PID 4968 wrote to memory of 3128	4968	EApp.exe	101
PID 4968 wrote to memory of 2968	4968	EApp.exe	102
PID 4968 wrote to memory of 3768	4968	EApp.exe	106
PID 3768 wrote to memory of 2908	3768	cmd.exe	108
PID 4968 wrote to memory of 2356	4968	EApp.exe	109
PID 4968 wrote to memory of 4708	4968	EApp.exe	110
PID 4968 wrote to memory of 4932	4968	EApp.exe	111
PID 4968 wrote to memory of 892	4968	EApp.exe	113
PID 4968 wrote to memory of 860	4968	EApp.exe	114
PID 4968 wrote to memory of 4984	4968	EApp.exe	116
PID 4968 wrote to memory of 1168	4968	EApp.exe	117
PID 4968 wrote to memory of 3680	4968	EApp.exe	123
PID 4968 wrote to memory of 708	4968	EApp.exe	124
PID 4968 wrote to memory of 692	4968	EApp.exe	125
PID 4968 wrote to memory of 3036	4968	EApp.exe	128
PID 4968 wrote to memory of 3452	4968	EApp.exe	130
PID 4968 wrote to memory of 2332	4968	EApp.exe	133
PID 4968 wrote to memory of 1704	4968	EApp.exe	134
PID 4968 wrote to memory of 3344	4968	EApp.exe	137

C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe
"C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\is-DAL9V89E05.tmp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DAL9V89E05.tmp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp" /SL5="$80170,59285838,1013760,C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe
    "C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe" /SILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\is-SH7ZLRJPD5.tmp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SH7ZLRJPD5.tmp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.tmp" /SL5="$90170,59285838,1013760,C:\Users\Admin\AppData\Local\Temp\_d3e52c02da188ac05436434c9401776b0a842386ada7aeabab4fae5cc64f8abd.exe" /SILENT
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:1496
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe" --type=gpu-process --field-trial-handle=1500,4631673618918583026,8501997748050626150,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1508 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-Y5Z64NJSKN.tmp\5KlazzeErsteWazze\EApp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,4631673618918583026,8501997748050626150,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1828 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1436
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
        6⤵
        
        PID:4724
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\system32\findstr.exe
        
        findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
        7⤵
        
        PID:2908
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2356
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4932
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:892
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:860
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4984
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1168
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3680
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:708
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:692
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3036
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3452
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2332
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1704
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...