Overview

overview

8

Static

static

3

emulatortool.exe

windows10-2004-x64

7

emulatortool.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    301s
  • max time network
    185s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emulatortool.exe
  • Size 155.4MB
  • Sample260622-td5edaev2s
  • SHA256 57349b250ca16b092d476510d2781181e1a9c698313af06e63c361962f7d7403
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 3 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 31 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\emulatortool.exe
    "C:\Users\Admin\AppData\Local\Temp\emulatortool.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4092
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" query "WinDefend"
      2⤵
      • Launches sc.exe
      PID:5756
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" query "WdFilter"
      2⤵
        PID:5488
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" query "WdNisDrv"
        2⤵
        • Launches sc.exe
        PID:2352
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" query "WdNisSvc"
        2⤵
        • Launches sc.exe
        PID:5156
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
        2⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" query "WinDefend"
        2⤵
        • Launches sc.exe
        PID:5928
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" query "WdFilter"
        2⤵
          PID:1192
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" query "WdNisDrv"
          2⤵
          • Launches sc.exe
          PID:4472
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" query "WdNisSvc"
          2⤵
            PID:5684
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            PID:2996
          • C:\Windows\system32\sc.exe
            "C:\Windows\system32\sc.exe" query "WinDefend"
            2⤵
              PID:1812
            • C:\Windows\system32\sc.exe
              "C:\Windows\system32\sc.exe" query "WdFilter"
              2⤵
                PID:2944
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" query "WdNisDrv"
                2⤵
                  PID:4524
                • C:\Windows\system32\sc.exe
                  "C:\Windows\system32\sc.exe" query "WdNisSvc"
                  2⤵
                    PID:3120
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                    2⤵
                    • Hide Artifacts: Ignore Process Interrupts
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3704
                  • C:\Windows\system32\sc.exe
                    "C:\Windows\system32\sc.exe" query "WinDefend"
                    2⤵
                      PID:5804
                    • C:\Windows\system32\sc.exe
                      "C:\Windows\system32\sc.exe" query "WdFilter"
                      2⤵
                      • Launches sc.exe
                      PID:2480
                    • C:\Windows\system32\sc.exe
                      "C:\Windows\system32\sc.exe" query "WdNisDrv"
                      2⤵
                      • Launches sc.exe
                      PID:5800
                    • C:\Windows\system32\sc.exe
                      "C:\Windows\system32\sc.exe" query "WdNisSvc"
                      2⤵
                        PID:4356
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                        2⤵
                        • Hide Artifacts: Ignore Process Interrupts
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4956
                      • C:\Windows\system32\sc.exe
                        "C:\Windows\system32\sc.exe" query "WinDefend"
                        2⤵
                          PID:5404
                        • C:\Windows\system32\sc.exe
                          "C:\Windows\system32\sc.exe" query "WdFilter"
                          2⤵
                            PID:4420
                          • C:\Windows\system32\sc.exe
                            "C:\Windows\system32\sc.exe" query "WdNisDrv"
                            2⤵
                            • Launches sc.exe
                            PID:3248
                          • C:\Windows\system32\sc.exe
                            "C:\Windows\system32\sc.exe" query "WdNisSvc"
                            2⤵
                              PID:596
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                              2⤵
                              • Hide Artifacts: Ignore Process Interrupts
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4332
                            • C:\Windows\system32\sc.exe
                              "C:\Windows\system32\sc.exe" query "WinDefend"
                              2⤵
                                PID:5460
                              • C:\Windows\system32\sc.exe
                                "C:\Windows\system32\sc.exe" query "WdFilter"
                                2⤵
                                  PID:5828
                                • C:\Windows\system32\sc.exe
                                  "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                  2⤵
                                  • Launches sc.exe
                                  PID:4788
                                • C:\Windows\system32\sc.exe
                                  "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                  2⤵
                                  • Launches sc.exe
                                  PID:1096
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                  2⤵
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4120
                                • C:\Windows\system32\sc.exe
                                  "C:\Windows\system32\sc.exe" query "WinDefend"
                                  2⤵
                                    PID:3416
                                  • C:\Windows\system32\sc.exe
                                    "C:\Windows\system32\sc.exe" query "WdFilter"
                                    2⤵
                                    • Launches sc.exe
                                    PID:6116
                                  • C:\Windows\system32\sc.exe
                                    "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                    2⤵
                                    • Launches sc.exe
                                    PID:3184
                                  • C:\Windows\system32\sc.exe
                                    "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                    2⤵
                                      PID:6132
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                      2⤵
                                      • Hide Artifacts: Ignore Process Interrupts
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4132
                                    • C:\Windows\system32\sc.exe
                                      "C:\Windows\system32\sc.exe" query "WinDefend"
                                      2⤵
                                        PID:3784
                                      • C:\Windows\system32\sc.exe
                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                        2⤵
                                          PID:4208
                                        • C:\Windows\system32\sc.exe
                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                          2⤵
                                          • Launches sc.exe
                                          PID:4968
                                        • C:\Windows\system32\sc.exe
                                          "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                          2⤵
                                          • Launches sc.exe
                                          PID:4756
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4524
                                        • C:\Windows\system32\sc.exe
                                          "C:\Windows\system32\sc.exe" query "WinDefend"
                                          2⤵
                                          • Launches sc.exe
                                          PID:4352
                                        • C:\Windows\system32\sc.exe
                                          "C:\Windows\system32\sc.exe" query "WdFilter"
                                          2⤵
                                          • Launches sc.exe
                                          PID:2444
                                        • C:\Windows\system32\sc.exe
                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                          2⤵
                                            PID:1232
                                          • C:\Windows\system32\sc.exe
                                            "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                            2⤵
                                            • Launches sc.exe
                                            PID:2712
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                            2⤵
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1500
                                          • C:\Windows\system32\sc.exe
                                            "C:\Windows\system32\sc.exe" query "WinDefend"
                                            2⤵
                                              PID:1512
                                            • C:\Windows\system32\sc.exe
                                              "C:\Windows\system32\sc.exe" query "WdFilter"
                                              2⤵
                                                PID:3800
                                              • C:\Windows\system32\sc.exe
                                                "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                2⤵
                                                • Launches sc.exe
                                                PID:2864
                                              • C:\Windows\system32\sc.exe
                                                "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                2⤵
                                                • Launches sc.exe
                                                PID:5724
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                2⤵
                                                • Hide Artifacts: Ignore Process Interrupts
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2060
                                              • C:\Windows\system32\sc.exe
                                                "C:\Windows\system32\sc.exe" query "WinDefend"
                                                2⤵
                                                • Launches sc.exe
                                                PID:5884
                                              • C:\Windows\system32\sc.exe
                                                "C:\Windows\system32\sc.exe" query "WdFilter"
                                                2⤵
                                                  PID:5804
                                                • C:\Windows\system32\sc.exe
                                                  "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                  2⤵
                                                    PID:2512
                                                  • C:\Windows\system32\sc.exe
                                                    "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                    2⤵
                                                      PID:1924
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                      2⤵
                                                      • Hide Artifacts: Ignore Process Interrupts
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3364
                                                    • C:\Windows\system32\sc.exe
                                                      "C:\Windows\system32\sc.exe" query "WinDefend"
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:5572
                                                    • C:\Windows\system32\sc.exe
                                                      "C:\Windows\system32\sc.exe" query "WdFilter"
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:3392
                                                    • C:\Windows\system32\sc.exe
                                                      "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:2568
                                                    • C:\Windows\system32\sc.exe
                                                      "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                      2⤵
                                                        PID:5968
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                        2⤵
                                                        • Hide Artifacts: Ignore Process Interrupts
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3468
                                                      • C:\Windows\system32\sc.exe
                                                        "C:\Windows\system32\sc.exe" query "WinDefend"
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:3796
                                                      • C:\Windows\system32\sc.exe
                                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                                        2⤵
                                                          PID:1212
                                                        • C:\Windows\system32\sc.exe
                                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:944
                                                        • C:\Windows\system32\sc.exe
                                                          "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:1480
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                          2⤵
                                                          • Hide Artifacts: Ignore Process Interrupts
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:4256
                                                        • C:\Windows\system32\sc.exe
                                                          "C:\Windows\system32\sc.exe" query "WinDefend"
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:2744
                                                        • C:\Windows\system32\sc.exe
                                                          "C:\Windows\system32\sc.exe" query "WdFilter"
                                                          2⤵
                                                            PID:1516
                                                          • C:\Windows\system32\sc.exe
                                                            "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                            2⤵
                                                              PID:3348
                                                            • C:\Windows\system32\sc.exe
                                                              "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                              2⤵
                                                                PID:3604
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                2⤵
                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1512
                                                              • C:\Windows\system32\sc.exe
                                                                "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:3220
                                                              • C:\Windows\system32\sc.exe
                                                                "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                2⤵
                                                                  PID:2360
                                                                • C:\Windows\system32\sc.exe
                                                                  "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                  2⤵
                                                                    PID:5976
                                                                  • C:\Windows\system32\sc.exe
                                                                    "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                    2⤵
                                                                      PID:3444
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                      2⤵
                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4080
                                                                    • C:\Windows\system32\sc.exe
                                                                      "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                      2⤵
                                                                        PID:4100
                                                                      • C:\Windows\system32\sc.exe
                                                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                        2⤵
                                                                          PID:1416
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                          2⤵
                                                                          • Launches sc.exe
                                                                          PID:3032
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                          2⤵
                                                                          • Launches sc.exe
                                                                          PID:5696
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                          2⤵
                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:3948
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                          2⤵
                                                                          • Launches sc.exe
                                                                          PID:1096
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                          2⤵
                                                                          • Launches sc.exe
                                                                          PID:5260
                                                                        • C:\Windows\system32\sc.exe
                                                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                          2⤵
                                                                            PID:4132
                                                                          • C:\Windows\system32\sc.exe
                                                                            "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                            2⤵
                                                                            • Launches sc.exe
                                                                            PID:5752
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                            2⤵
                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2832
                                                                          • C:\Windows\system32\sc.exe
                                                                            "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                            2⤵
                                                                            • Launches sc.exe
                                                                            PID:5888
                                                                          • C:\Windows\system32\sc.exe
                                                                            "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                            2⤵
                                                                              PID:5240
                                                                            • C:\Windows\system32\sc.exe
                                                                              "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                              2⤵
                                                                                PID:1344
                                                                              • C:\Windows\system32\sc.exe
                                                                                "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                2⤵
                                                                                  PID:2100
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                  2⤵
                                                                                  • Hide Artifacts: Ignore Process Interrupts
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1588
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:2016
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:912
                                                                                • C:\Windows\system32\sc.exe
                                                                                  "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                  2⤵
                                                                                    PID:1104
                                                                                  • C:\Windows\system32\sc.exe
                                                                                    "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                    2⤵
                                                                                      PID:2796
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                      2⤵
                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5580
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:5924
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2464
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:4868
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                      2⤵
                                                                                        PID:3124
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                        2⤵
                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:2256
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                        2⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2244
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                        2⤵
                                                                                        • Launches sc.exe
                                                                                        PID:2260
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                        2⤵
                                                                                          PID:5268
                                                                                        • C:\Windows\system32\sc.exe
                                                                                          "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                          2⤵
                                                                                          • Launches sc.exe
                                                                                          PID:4964
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                          2⤵
                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4872
                                                                                        • C:\Windows\system32\sc.exe
                                                                                          "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                          2⤵
                                                                                            PID:632
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:5060
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:5404
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:4360
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                            2⤵
                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:2764
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                            2⤵
                                                                                              PID:3204
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4980
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2628
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                              2⤵
                                                                                                PID:2736
                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                2⤵
                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:4196
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                2⤵
                                                                                                  PID:1128
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                  2⤵
                                                                                                    PID:1044
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                    2⤵
                                                                                                      PID:2716
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1456
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                      2⤵
                                                                                                      • Hide Artifacts: Ignore Process Interrupts
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:796
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1120
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:888
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1956
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                      2⤵
                                                                                                        PID:5680
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                        2⤵
                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:2240
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                        2⤵
                                                                                                        • Launches sc.exe
                                                                                                        PID:5944
                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                        2⤵
                                                                                                          PID:5516
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:4112
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2352
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                          2⤵
                                                                                                          • Hide Artifacts: Ignore Process Interrupts
                                                                                                          PID:5632
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                          2⤵
                                                                                                            PID:4620
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                            2⤵
                                                                                                              PID:4792
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:2836
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:4972
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                              2⤵
                                                                                                              • Hide Artifacts: Ignore Process Interrupts
                                                                                                              PID:5556
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:2988
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:3592
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:5456
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                              2⤵
                                                                                                                PID:1688
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                                2⤵
                                                                                                                • Hide Artifacts: Ignore Process Interrupts
                                                                                                                PID:4756
                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                                2⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:5736
                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                                2⤵
                                                                                                                  PID:4960
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                                  2⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:2540
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                                  2⤵
                                                                                                                    PID:1804
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                                    2⤵
                                                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                                                    PID:3816
                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                    "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                                    2⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:2424
                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                    "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                                    2⤵
                                                                                                                      PID:1220
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                                      2⤵
                                                                                                                        PID:4568
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                                        2⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:4584
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue' $status = $null $pref = $null if (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue) { $status = Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled, AMServiceEnabled, IsTamperProtected } if (Get-Command Get-MpPreference -ErrorAction SilentlyContinue) { $pref = Get-MpPreference | Select-Object DisableBehaviorMonitoring, EnableNetworkProtection, MAPSReporting, PUAProtection } [PSCustomObject]@{ Status = $status Preference = $pref } | ConvertTo-Json -Compress -Depth 4"
                                                                                                                        2⤵
                                                                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                                                                        PID:6100
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        "C:\Windows\system32\sc.exe" query "WinDefend"
                                                                                                                        2⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:5172
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        "C:\Windows\system32\sc.exe" query "WdFilter"
                                                                                                                        2⤵
                                                                                                                          PID:5520
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          "C:\Windows\system32\sc.exe" query "WdNisDrv"
                                                                                                                          2⤵
                                                                                                                            PID:2816
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            "C:\Windows\system32\sc.exe" query "WdNisSvc"
                                                                                                                            2⤵
                                                                                                                              PID:5972
                                                                                                                          • C:\Windows\system32\sihost.exe
                                                                                                                            sihost.exe
                                                                                                                            1⤵
                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4580
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe /LOADSAVEDWINDOWS
                                                                                                                              2⤵
                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                              • Enumerates connected drives
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1320
                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:1060
                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:108

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 60543d202129be3beb7f7d51a1c1b0917d1d0409e4b431fda3c17835de79d4c4
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 987d9c751aa695325be8e1e788e661da9c9a3cbce03fdf90d2dd0f6a67e106e7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 cdaf9d7a6e7340973317bce539399ae5411afa6e2ab55f4139174cd10443232b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 d8120af223a15c1b2ca4875a35d5b4f377ab934020ff4ff6d63b4890b8542605
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 2bf4d6b8f9aa8cb6bac4830e0464c583f1e9adda787875374d167efa29275140
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 6db061dbba79455aac3753741aa56da2c38ae7a250d7050455da757229ba5dfd
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 fbc40a68eb025e52e10a258d775ac1dbf72eb582ca67617ca57e27cef7f8b35f
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 b718eab0aa862e99a4ffaff87e55334c9a834a2b9b32184638bd6348d762b059
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 641a3cb19bad09236275dab8fa70f5521659a8794414e4f549aa8e592bb1bdf2
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 c331788358f25a83faa4c6f32f0f7ea26b94238760bcb80339b9627c0889c27a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 ae528015017b507c494ab6b00abd54305643bcfb5e96f9fe33655a301e02d907
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 bb1685474865a21e5c16638c7593f9684239e87b0b1c1ab89176ba040c75e2d9
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 e93ccb919f7311d29c5a8b86c8c38c8c235d11584cb818f278a021f9b81c1122
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 ab5d2cf1313a6b2898d581432bfe0d3dddbae3f26fafaa6e1dbf47b1b1b3b419
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 d99cbef885fd26548dba6b67e65f574269764ce4454f32f446a346c11d8e80ce
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 62fbb5863bc4f4c9141b40d2cf8d0c7a8ceb6675ebca00d36ffd609885f32d79
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 2eba2fe04c923835a942679cb978d38d7541e553579a12657411c6b09154598d
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 ed01cdd24a696457dbbf4e8b773fea9917d2b757cf7791a73bf5839ca14cdea6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 73468182e3d84d6eb6c50725511c05a97fa8dbaa5f4cfc090f3773d004c1d463
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 8725031977569b2e7cf4b702707017ea63dabd185f48fbe6ccfd9e1d1c9de442
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 9b33f40fdb44074444661b9f2a35622e367ac6915a78aa17c520c421474c7bec
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 5fa3053eae30cdc7b6d9385b4d60c2774f378195b6841bd1aaa98594118d6653
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 c6b5b99d5bc10d958f5353e57221a10cd260f65f2b73ff0aa866b3280bdcc522
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 c612ee18b7ba13448460b4e1f1e65d9ec7a6550f1edd3b312e9055b0d9bc1c22
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 6416c2b148ab411bc20119d5afa66856e3b566215ac7cbc88a67de751aed258b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 c0becc0181a0f71d822544081a38076b87140bf9d54de31ce1680a599c3d59f7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 7d5dd886b531ef7cb450f487e08b62f9fa9a2e637d5677adcc5565139a036ee4
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 e2cfdc1d5be520c6dce8ac61a1f674207800804afa8be09890d8c7d3717a27cc
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 a159694092232bc3fe435e666d3cf9a5a8eaee9a512f9204d7ca03a7466e7617
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 a45859acf6487a78631d04e2e93ab1778d4a0f9422701eceb95abb2cfa405c10
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                • Size 599B
                                                                                                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                D3DCompiler_47_cor3.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.net\emulatortool\DPPFtgXgZK7d\D3DCompiler_47_cor3.dll
                                                                                                                                • Size 4.5MB
                                                                                                                                • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                PresentationNative_cor3.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.net\emulatortool\DPPFtgXgZK7d\PresentationNative_cor3.dll
                                                                                                                                • Size 1.2MB
                                                                                                                                • SHA256 67629b6aaee39328d02b11e5d85a53b35aa6cea71d4d37a671295a76c02b240e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wpfgfx_cor3.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\.net\emulatortool\DPPFtgXgZK7d\wpfgfx_cor3.dll
                                                                                                                                • Size 1.9MB
                                                                                                                                • SHA256 1c1c5d5ae7530615585b77a8b15588ed51ea66da9a75fceeea7f772970edc01f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                __PSScriptPolicyTest_zctrkvnr.eig.ps1
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zctrkvnr.eig.ps1
                                                                                                                                • Size 60B
                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/796-446-0x0000016CE7CD0000-0x0000016CE7D82000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-94-0x000002D283B00000-0x000002D283B20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-81-0x000002D2838C0000-0x000002D2838E0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-75-0x000002D280050000-0x000002D280150000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-120-0x000002D294080000-0x000002D2940A0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-74-0x000002D280050000-0x000002D280150000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1060-82-0x000002D283CC0000-0x000002D283DC0000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1320-265-0x0000000006030000-0x00000000068E3000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2832-388-0x0000017B70AB0000-0x0000017B70B62000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-23-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-28-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-13-0x00007FFA83DFF000-0x00007FFA83E00000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-14-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-40-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-38-0x000002347EFB0000-0x000002347F4D8000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-37-0x000002347E8B0000-0x000002347EA72000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-36-0x000002347E160000-0x000002347E16A000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-35-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-17-0x000002347E0C0000-0x000002347E0E2000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-33-0x000002347E140000-0x000002347E15E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-34-0x000002347E3D0000-0x000002347E482000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-30-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-29-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-18-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-19-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-27-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-26-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-25-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-24-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-20-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-21-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4092-22-0x00007FFA83C70000-0x00007FFA84614000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4120-258-0x000001B9FF7F0000-0x000001B9FF8A2000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4132-271-0x000001E63C250000-0x000001E63C302000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4196-437-0x0000021049F60000-0x000002104A012000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4256-355-0x0000025275BD0000-0x0000025275C82000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4332-71-0x0000023842780000-0x0000023842832000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4580-264-0x000001B9F98E0000-0x000001B9FA193000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4956-64-0x0000025EB30E0000-0x0000025EB3192000-memory.dmp
                                                                                                                                Download