691dc0c50cee6b32dc04a6d3ef6d27e162fafa9e15de95f1c6ff2506dee74414

Resubmissions

24/08/2026, 17:33

260824-v4zggsaq7v8

24/08/2026, 17:31

260824-v3regsec878

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pc_scanner.exe
Size 15.3MB
Sample260824-v3regsec87
SHA256 691dc0c50cee6b32dc04a6d3ef6d27e162fafa9e15de95f1c6ff2506dee74414
MD5 029da140f5c7e57c42b42b7ad028b70b
SHA1 e182aff257737a6228d65da034b8fe009076b04d
SHA512 43482fe2e92caeb11c3385211e51777ba4d9a96fa7b6e60d9a6a1a4f0aacbce9c50196f987eefdb236c7adbd98fec9b7183a064f204bb427fe1c527e7fcbc8f8
SSDEEP 393216:WnVJE2TNgIfUKOcR1iOPsZg2KeQK4VHsF5laSrHbYy3NS4:SvN58KPR1irLXkEUSLb1
TLSH
T123F63369D7E10D76ECA7693F19B84163E3B1B0204795C5DF0BE0432A2FA72E5683E361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 34 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
3660	powershell.exe
3372	powershell.exe
700	powershell.exe
4584	powershell.exe
2440	powershell.exe
3584	powershell.exe
1824	powershell.exe
2496	powershell.exe
3360	powershell.exe
5056	powershell.exe
4088	powershell.exe
3944	powershell.exe
5048	powershell.exe
1348	powershell.exe
3460	powershell.exe
1040	powershell.exe
4208	powershell.exe
4628	powershell.exe
1752	powershell.exe
3436	powershell.exe
3408	powershell.exe
4140	powershell.exe
2564	powershell.exe
1536	powershell.exe
3344	powershell.exe
752	powershell.exe
3488	powershell.exe
740	powershell.exe
4744	powershell.exe
3256	powershell.exe
692	powershell.exe
3960	powershell.exe
896	powershell.exe
4120	powershell.exe

Loads dropped DLL 22 IoCs

pid	Process
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe
1972	pc_scanner.exe

Contacts third-party web service commonly abused for C2 1 TTPs 42 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	discord.com
59	discord.com
69	discord.com
9	discord.com
37	discord.com
61	discord.com
67	discord.com
71	discord.com
79	discord.com
84	discord.com
55	discord.com
60	discord.com
64	discord.com
68	discord.com
63	discord.com
40	discord.com
51	discord.com
57	discord.com
70	discord.com
52	discord.com
53	discord.com
58	discord.com
62	discord.com
66	discord.com
82	discord.com
83	discord.com
72	discord.com
75	discord.com
47	discord.com
11	discord.com
18	discord.com
19	discord.com
21	discord.com
39	discord.com
56	discord.com
41	discord.com
46	discord.com
48	discord.com
54	discord.com
65	discord.com
10	discord.com
20	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
49	api.ipify.org
50	api.ipify.org

Power Settings 1 TTPs 6 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3956	powershell.exe
1824	powercfg.exe
3556	powershell.exe
2688	powercfg.exe
2632	powershell.exe
4088	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 5 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
928	powershell.exe
4932	powershell.exe
4088	powershell.exe
2204	powershell.exe
896	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1972	pc_scanner.exe
1972	pc_scanner.exe
3956	powershell.exe
3956	powershell.exe
3436	powershell.exe
3436	powershell.exe
3408	powershell.exe
3408	powershell.exe
3556	powershell.exe
3556	powershell.exe
2496	powershell.exe
2496	powershell.exe
3488	powershell.exe
3488	powershell.exe
1040	powershell.exe
1040	powershell.exe
3360	powershell.exe
3360	powershell.exe
4140	powershell.exe
4140	powershell.exe
4208	powershell.exe
4208	powershell.exe
2564	powershell.exe
2564	powershell.exe
740	powershell.exe
740	powershell.exe
5056	powershell.exe
5056	powershell.exe
4088	powershell.exe
4088	powershell.exe
4744	powershell.exe
4744	powershell.exe
3960	powershell.exe
3960	powershell.exe
3660	powershell.exe
3660	powershell.exe
3372	powershell.exe
3372	powershell.exe
1536	powershell.exe
1536	powershell.exe
928	powershell.exe
928	powershell.exe
4932	powershell.exe
4932	powershell.exe
4088	powershell.exe
4088	powershell.exe
3256	powershell.exe
3256	powershell.exe
692	powershell.exe
692	powershell.exe
3344	powershell.exe
3344	powershell.exe
3944	powershell.exe
3944	powershell.exe
700	powershell.exe
700	powershell.exe
4584	powershell.exe
4584	powershell.exe
2204	powershell.exe
2204	powershell.exe
2632	powershell.exe
2632	powershell.exe
896	powershell.exe
896	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	pc_scanner.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 1972	3596	pc_scanner.exe	84
PID 1972 wrote to memory of 3956	1972	pc_scanner.exe	86
PID 3956 wrote to memory of 1824	3956	powershell.exe	88
PID 1972 wrote to memory of 3436	1972	pc_scanner.exe	89
PID 1972 wrote to memory of 3408	1972	pc_scanner.exe	91
PID 1972 wrote to memory of 3556	1972	pc_scanner.exe	99
PID 3556 wrote to memory of 2688	3556	powershell.exe	101
PID 1972 wrote to memory of 2496	1972	pc_scanner.exe	102
PID 1972 wrote to memory of 3488	1972	pc_scanner.exe	104
PID 1972 wrote to memory of 1040	1972	pc_scanner.exe	109
PID 1972 wrote to memory of 3360	1972	pc_scanner.exe	111
PID 1972 wrote to memory of 4140	1972	pc_scanner.exe	113
PID 1972 wrote to memory of 4208	1972	pc_scanner.exe	115
PID 1972 wrote to memory of 2564	1972	pc_scanner.exe	117
PID 1972 wrote to memory of 740	1972	pc_scanner.exe	119
PID 1972 wrote to memory of 5056	1972	pc_scanner.exe	121
PID 1972 wrote to memory of 4088	1972	pc_scanner.exe	125
PID 1972 wrote to memory of 4744	1972	pc_scanner.exe	127
PID 1972 wrote to memory of 3960	1972	pc_scanner.exe	129
PID 1972 wrote to memory of 3660	1972	pc_scanner.exe	131
PID 1972 wrote to memory of 3372	1972	pc_scanner.exe	134
PID 1972 wrote to memory of 1536	1972	pc_scanner.exe	136
PID 1972 wrote to memory of 928	1972	pc_scanner.exe	138
PID 1972 wrote to memory of 4932	1972	pc_scanner.exe	140
PID 1972 wrote to memory of 4088	1972	pc_scanner.exe	143
PID 1972 wrote to memory of 3256	1972	pc_scanner.exe	145
PID 3256 wrote to memory of 4352	3256	powershell.exe	147
PID 1972 wrote to memory of 692	1972	pc_scanner.exe	148
PID 692 wrote to memory of 4436	692	powershell.exe	150
PID 1972 wrote to memory of 3344	1972	pc_scanner.exe	151
PID 1972 wrote to memory of 3944	1972	pc_scanner.exe	153
PID 1972 wrote to memory of 700	1972	pc_scanner.exe	155
PID 1972 wrote to memory of 4584	1972	pc_scanner.exe	157
PID 1972 wrote to memory of 2204	1972	pc_scanner.exe	159
PID 1972 wrote to memory of 2632	1972	pc_scanner.exe	161
PID 2632 wrote to memory of 4088	2632	powershell.exe	163
PID 1972 wrote to memory of 896	1972	pc_scanner.exe	164
PID 1972 wrote to memory of 4120	1972	pc_scanner.exe	166
PID 1972 wrote to memory of 4628	1972	pc_scanner.exe	168
PID 1972 wrote to memory of 2440	1972	pc_scanner.exe	170
PID 1972 wrote to memory of 3584	1972	pc_scanner.exe	172
PID 1972 wrote to memory of 1824	1972	pc_scanner.exe	174
PID 1972 wrote to memory of 5048	1972	pc_scanner.exe	176
PID 1972 wrote to memory of 1752	1972	pc_scanner.exe	178
PID 1972 wrote to memory of 752	1972	pc_scanner.exe	180
PID 1972 wrote to memory of 1348	1972	pc_scanner.exe	182
PID 1972 wrote to memory of 3460	1972	pc_scanner.exe	184

C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe
"C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe
  "C:\Users\Admin\AppData\Local\Temp\pc_scanner.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $csp = Get-CimInstance Win32_ComputerSystemProduct $page = Get-CimInstance Win32_PageFileUsage $activePlan = (powercfg /getactivescheme 2>$null | Out-String).Trim() $secureBoot = $null try { $secureBoot = Confirm-SecureBootUEFI -ErrorAction Stop } catch {} $tpm = $null try { $tpm = Get-Tpm | Select-Object TpmPresent, TpmReady, ManagedAuthLevel, ManufacturerIdTxt, ManufacturerVersion } catch {} [PSCustomObject]@{ Caption = $os.Caption Version = $os.Version Build = $os.BuildNumber Architecture = $os.OSArchitecture InstallDate = $os.InstallDate LastBoot = $os.LastBootUpTime RegisteredUser = $os.RegisteredUser SerialNumber = $os.SerialNumber WindowsDirectory = $os.WindowsDirectory SystemDirectory = $os.SystemDirectory ComputerManufacturer = $cs.Manufacturer ComputerModel = $cs.Model SystemFamily = $csp.Version SystemSku = $csp.SKUNumber TotalPhysicalMemoryBytes = $cs.TotalPhysicalMemory VirtualizationFirmwareEnabled = $cs.VirtualizationFirmwareEnabled HypervisorPresent = $cs.HypervisorPresent SecureBoot = $secureBoot ActivePowerPlan = $activePlan PageFiles = @($page | ForEach-Object { [PSCustomObject]@{ Name=$_.Name; AllocatedBaseSizeMB=$_.AllocatedBaseSize; CurrentUsageMB=$_.CurrentUsage; PeakUsageMB=$_.PeakUsage } }) TPM = $tpm } | ConvertTo-Json -Depth 6 -Compress "
    3⤵
    - Power Settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /getactivescheme
      4⤵
      Power Settings
      PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $cs = Get-CimInstance Win32_ComputerSystem $prod = Get-CimInstance Win32_ComputerSystemProduct $bios = Get-CimInstance Win32_BIOS [PSCustomObject]@{ Manufacturer = $cs.Manufacturer Model = $cs.Model SystemType = $cs.SystemType Domain = $cs.Domain Workgroup = $cs.Workgroup PartOfDomain = $cs.PartOfDomain ProductName = $prod.Name ProductVersion = $prod.Version ProductSerial = $prod.IdentifyingNumber BIOSVersion = (($bios.SMBIOSBIOSVersion -join '; ')) SMBIOSMajor = $bios.SMBIOSMajorVersion SMBIOSMinor = $bios.SMBIOSMinorVersion } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance SoftwareLicensingProduct | Where-Object { $_.PartialProductKey -and $_.Name -like 'Windows*' } | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Description = $_.Description LicenseStatus = $_.LicenseStatus PartialProductKey = $_.PartialProductKey GracePeriodMinutes = $_.GracePeriodRemaining } } | Select-Object -Unique Name, Description, LicenseStatus, PartialProductKey, GracePeriodMinutes | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "powercfg /a 2>$null"
    3⤵
    - Power Settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /a
      4⤵
      Power Settings
      PID:2688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_Processor | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Manufacturer = $_.Manufacturer PhysicalCores = $_.NumberOfCores LogicalProcessors = $_.NumberOfLogicalProcessors BaseClockMHz = $_.CurrentClockSpeed MaxClockMHz = $_.MaxClockSpeed CurrentClockMHz = $_.CurrentClockSpeed Socket = $_.SocketDesignation Architecture = $_.Architecture L2CacheKB = $_.L2CacheSize L3CacheKB = $_.L3CacheSize AddressWidth = $_.AddressWidth DataWidth = $_.DataWidth VirtualizationFirmwareEnabled = $_.VirtualizationFirmwareEnabled SecondLevelAddressTranslationExtensions = $_.SecondLevelAddressTranslationExtensions VMMonitorModeExtensions = $_.VMMonitorModeExtensions Status = $_.Status } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, CsNumberOfLogicalProcessors, CsNumberOfProcessors | Format-List | Out-String"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_VideoController | ForEach-Object { [PSCustomObject]@{ Name = $_.Name Manufacturer = $_.AdapterCompatibility VRAMBytes = $_.AdapterRAM DriverVersion = $_.DriverVersion DriverDate = $_.DriverDate VideoProcessor = $_.VideoProcessor CurrentBitsPerPixel = $_.CurrentBitsPerPixel Resolution = \"$($_.CurrentHorizontalResolution)x$($_.CurrentVerticalResolution)\" HorizontalResolution = $_.CurrentHorizontalResolution VerticalResolution = $_.CurrentVerticalResolution RefreshRate = $_.CurrentRefreshRate PNPDeviceID = $_.PNPDeviceID DeviceID = $_.DeviceID Status = $_.Status VideoModeDescription = $_.VideoModeDescription } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_BaseBoard | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer Model = $_.Product Version = $_.Version Serial = $_.SerialNumber PartNumber = $_.PartNumber HostingBoard = $_.HostingBoard Status = $_.Status } } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_BIOS | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer Name = $_.Name Version = $_.SMBIOSBIOSVersion ReleaseDate = $_.ReleaseDate Serial = $_.SerialNumber SMBIOSMajor = $_.SMBIOSMajorVersion SMBIOSMinor = $_.SMBIOSMinorVersion Status = $_.Status } } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_PhysicalMemory | ForEach-Object { [PSCustomObject]@{ Manufacturer = $_.Manufacturer PartNumber = $_.PartNumber CapacityBytes = $_.Capacity SpeedMHz = $_.Speed ConfiguredSpeedMHz = $_.ConfiguredClockSpeed ConfiguredVoltage = $_.ConfiguredVoltage MinVoltage = $_.MinVoltage MaxVoltage = $_.MaxVoltage Slot = $_.DeviceLocator BankLabel = $_.BankLabel Serial = $_.SerialNumber SMBIOSMemoryType = $_.SMBIOSMemoryType FormFactor = $_.FormFactor DataWidth = $_.DataWidth TotalWidth = $_.TotalWidth TypeDetail = $_.TypeDetail } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $modules = @(Get-CimInstance Win32_PhysicalMemory) $cs = Get-CimInstance Win32_ComputerSystem [PSCustomObject]@{ InstalledCapacityBytes = ($modules | Measure-Object Capacity -Sum).Sum ModuleCount = $modules.Count AvailableRamSlots = $null PhysicalMemoryBytes = $cs.TotalPhysicalMemory ErrorCorrection = (($modules | Select-Object -First 1).DataWidth) } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_DiskDrive | ForEach-Object { [PSCustomObject]@{ Model = $_.Model Manufacturer = $_.Manufacturer Serial = $_.SerialNumber Interface = $_.InterfaceType MediaType = $_.MediaType SizeBytes = $_.Size Firmware = $_.FirmwareRevision DeviceID = $_.DeviceID PNPDeviceID = $_.PNPDeviceID Status = $_.Status BytesPerSector = $_.BytesPerSector Partitions = $_.Partitions } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PhysicalDisk | ForEach-Object { [PSCustomObject]@{ FriendlyName=$_.FriendlyName SerialNumber=$_.SerialNumber MediaType=$_.MediaType BusType=$_.BusType SizeBytes=$_.Size HealthStatus=$_.HealthStatus OperationalStatus=$_.OperationalStatus Usage=$_.Usage FirmwareVersion=$_.FirmwareVersion CanPool=$_.CanPool SpindleSpeed=$_.SpindleSpeed } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $result = @() try { $disks = @(Get-PhysicalDisk) foreach ($d in $disks) { try { $r = Get-StorageReliabilityCounter -PhysicalDisk $d -ErrorAction Stop $result += [PSCustomObject]@{ FriendlyName=$d.FriendlyName SerialNumber=$d.SerialNumber TemperatureC=$r.Temperature ReadErrorsTotal=$r.ReadErrorsTotal ReadErrorsUncorrected=$r.ReadErrorsUncorrected WriteErrorsTotal=$r.WriteErrorsTotal WriteErrorsUncorrected=$r.WriteErrorsUncorrected Wear=$r.Wear PowerOnHours=$r.PowerOnHours PowerCycleCount=$r.PowerCycleCount ReadLatencyMax=$r.ReadLatencyMax WriteLatencyMax=$r.WriteLatencyMax } } catch {} } } catch {} $result | ConvertTo-Json -Depth 6 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Volume | ForEach-Object { [PSCustomObject]@{ DriveLetter=$_.DriveLetter Path=$_.Path FileSystem=$_.FileSystem FileSystemLabel=$_.FileSystemLabel SizeBytes=$_.Size SizeRemainingBytes=$_.SizeRemaining HealthStatus=$_.HealthStatus OperationalStatus=$_.OperationalStatus DriveType=$_.DriveType } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Partition | ForEach-Object { [PSCustomObject]@{ DiskNumber=$_.DiskNumber PartitionNumber=$_.PartitionNumber DriveLetter=$_.DriveLetter SizeBytes=$_.Size OffsetBytes=$_.Offset Type=$_.Type GptType=$_.GptType IsBoot=$_.IsBoot IsSystem=$_.IsSystem IsActive=$_.IsActive } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $monitors = @(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID -ErrorAction SilentlyContinue) $basic = @(Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue) $result = foreach ($monitor in $monitors) { $manufacturer = -join ($monitor.ManufacturerName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $product = -join ($monitor.ProductCodeID | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $serial = -join ($monitor.SerialNumberID | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $user = -join ($monitor.UserFriendlyName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) $instance = -join ($monitor.InstanceName | Where-Object { $_ -ne 0 } | ForEach-Object { [char]$_ }) [PSCustomObject]@{ Manufacturer=$manufacturer ProductCode=$product Serial=$serial UserFriendlyName=$user InstanceName=$instance Active=$monitor.Active } } $result | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InstanceName=$_.InstanceName Active=$_.Active MaxHorizontalImageSizeCm=$_.MaxHorizontalImageSize MaxVerticalImageSizeCm=$_.MaxVerticalImageSize VideoInputType=$_.VideoInputType } } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_DesktopMonitor | ForEach-Object { [PSCustomObject]@{ Name=$_.Name MonitorType=$_.MonitorType PNPDeviceID=$_.PNPDeviceID ScreenHeight=$_.ScreenHeight ScreenWidth=$_.ScreenWidth Status=$_.Status } } | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-NetAdapter -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ Name=$_.Name InterfaceDescription=$_.InterfaceDescription Manufacturer=$_.Manufacturer MacAddress=$_.MacAddress LinkSpeed=$_.LinkSpeed Status=$_.Status MediaType=$_.MediaType DriverInformation=($null) ifIndex=$_.ifIndex Virtual=$_.Virtual } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-NetIPConfiguration -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InterfaceAlias=$_.InterfaceAlias InterfaceIndex=$_.InterfaceIndex IPv4Address=@($_.IPv4Address | ForEach-Object { $_.IPAddress }) IPv6Address=@($_.IPv6Address | ForEach-Object { $_.IPAddress }) IPv4DefaultGateway=@($_.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) IPv6DefaultGateway=@($_.IPv6DefaultGateway | ForEach-Object { $_.NextHop }) DNSServers=@($_.DNSServer | ForEach-Object { $_.ServerAddresses }) NetProfileName=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).Name NetworkCategory=(Get-NetConnectionProfile -InterfaceIndex $_.InterfaceIndex -ErrorAction SilentlyContinue).NetworkCategory } } | ConvertTo-Json -Depth 7 -Compress "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-DnsClientServerAddress -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ InterfaceAlias=$_.InterfaceAlias AddressFamily=$_.AddressFamily ServerAddresses=@($_.ServerAddresses) } } | Where-Object { $_.ServerAddresses.Count -gt 0 } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show interfaces 2>$null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "netsh wlan show networks mode=bssid 2>$null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetTCPConnection -ErrorAction Stop | Sort-Object State,RemoteAddress | Select-Object -First 50 | ForEach-Object { [PSCustomObject]@{ LocalAddress=$_.LocalAddress LocalPort=$_.LocalPort RemoteAddress=$_.RemoteAddress RemotePort=$_.RemotePort State=$_.State OwningProcess=$_.OwningProcess } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetTCPConnection -State Listen -ErrorAction Stop | Sort-Object LocalPort | Select-Object -First 100 | ForEach-Object { [PSCustomObject]@{ LocalAddress=$_.LocalAddress LocalPort=$_.LocalPort OwningProcess=$_.OwningProcess } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $temps = Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue $result = foreach ($temp in $temps) { $celsius = ($temp.CurrentTemperature / 10) - 273.15 [PSCustomObject]@{ Zone = $temp.InstanceName TemperatureC = [math]::Round($celsius, 1) CriticalTripPointC = if ($temp.CriticalTripPoint) { [math]::Round(($temp.CriticalTripPoint / 10) - 273.15, 1) } else { $null } PassiveTripPointC = if ($temp.PassiveTripPoint) { [math]::Round(($temp.PassiveTripPoint / 10) - 273.15, 1) } else { $null } } } $result | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $result = @() $providers = @( @{ Namespace='root\LibreHardwareMonitor'; Name='LibreHardwareMonitor' }, @{ Namespace='root\OpenHardwareMonitor'; Name='OpenHardwareMonitor' } ) foreach ($provider in $providers) { try { $sensors = Get-CimInstance -Namespace $provider.Namespace -ClassName Sensor -ErrorAction Stop foreach ($sensor in $sensors) { $result += [PSCustomObject]@{ Name = $sensor.Name Hardware = $sensor.Hardware SensorType = $sensor.SensorType Value = $sensor.Value Min = $sensor.Min Max = $sensor.Max Index = $sensor.Index InstanceId = $sensor.InstanceId Provider = $provider.Name } } if ($result.Count -gt 0) { break } } catch {} } $result | ConvertTo-Json -Depth 6 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " Get-CimInstance Win32_Battery -ErrorAction SilentlyContinue | ForEach-Object { [PSCustomObject]@{ Name=$_.Name DeviceID=$_.DeviceID Status=$_.Status BatteryStatus=$_.BatteryStatus EstimatedChargeRemaining=$_.EstimatedChargeRemaining EstimatedRunTimeMinutes=$_.EstimatedRunTime DesignVoltage=$_.DesignVoltage Chemistry=$_.Chemistry Availability=$_.Availability } } | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "powercfg /getactivescheme 2>$null"
    3⤵
    - Power Settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\powercfg.exe
      "C:\Windows\system32\powercfg.exe" /getactivescheme
      4⤵
      Power Settings
      PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $paths = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $result = foreach ($path in $paths) { try { Get-ItemProperty $path -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ Name=$_.DisplayName Version=$_.DisplayVersion Publisher=$_.Publisher InstallDate=$_.InstallDate InstallLocation=$_.InstallLocation } } } catch {} } $result | Where-Object { $_.Name } | Sort-Object Name -Unique | Select-Object -First 250 | ConvertTo-Json -Depth 4 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " $items = @() $locations = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce', 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce' ) foreach ($path in $locations) { try { $props = Get-ItemProperty -Path $path -ErrorAction Stop foreach ($property in $props.PSObject.Properties) { if ($property.Name -notlike 'PS*') { $items += [PSCustomObject]@{ Location=$path Name=$property.Name Command=[string]$property.Value } } } } catch {} } try { Get-CimInstance Win32_StartupCommand | ForEach-Object { $items += [PSCustomObject]@{ Location=$_.Location Name=$_.Name Command=$_.Command User=$_.User } } } catch {} $items | ConvertTo-Json -Depth 5 -Compress "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-CimInstance Win32_Service | Where-Object { $_.State -eq 'Running' -or $_.StartMode -eq 'Auto' } | ForEach-Object { [PSCustomObject]@{ Name=$_.Name DisplayName=$_.DisplayName State=$_.State StartMode=$_.StartMode StartName=$_.StartName PathName=$_.PathName } } | Sort-Object State,Name | Select-Object -First 250 | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, AntispywareEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled, NISEnabled, RealTimeProtectionEnabled, AntivirusSignatureVersion, AntispywareSignatureVersion, QuickScanAge, FullScanAge | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-NetFirewallProfile | ForEach-Object { [PSCustomObject]@{ Name=$_.Name; Enabled=$_.Enabled; DefaultInboundAction=$_.DefaultInboundAction; DefaultOutboundAction=$_.DefaultOutboundAction } } | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-BitLockerVolume | ForEach-Object { [PSCustomObject]@{ MountPoint=$_.MountPoint; VolumeStatus=$_.VolumeStatus; ProtectionStatus=$_.ProtectionStatus; EncryptionMethod=$_.EncryptionMethod; EncryptionPercentage=$_.EncryptionPercentage } } | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerIdTxt, ManufacturerVersion, ManagedAuthLevel | ConvertTo-Json -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3} -MaxEvents 20 -ErrorAction Stop | ForEach-Object { [PSCustomObject]@{ TimeCreated=$_.TimeCreated Id=$_.Id Level=$_.LevelDisplayName Provider=$_.ProviderName Message=$_.Message } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2,3} -MaxEvents 20 -ErrorAction Stop | ForEach-Object { [PSCustomObject]@{ TimeCreated=$_.TimeCreated Id=$_.Id Level=$_.LevelDisplayName Provider=$_.ProviderName Message=$_.Message } } | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PnpDevice -PresentOnly -ErrorAction Stop | Group-Object Class | ForEach-Object { [PSCustomObject]@{ Class=$_.Name; Count=$_.Count } } | Sort-Object Class | ConvertTo-Json -Depth 4 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command " try { Get-PnpDevice -ErrorAction Stop | Where-Object { $_.Status -ne 'OK' } | Select-Object -First 100 Class, FriendlyName, InstanceId, Manufacturer, Status, ProblemCode | ConvertTo-Json -Depth 5 -Compress } catch { @() | ConvertTo-Json -Compress } "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...