havoc | 14df73f68eaf92accabcc339366e94a4384f7cb26348f37c212a9f50f5bba76a

Analysis

user interaction
yes
max time kernel
10s
max time network
50s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OGFN Ext by Fr4nky.exe
Size 160KB
Sample260830-wzt7mscf78
SHA256 14df73f68eaf92accabcc339366e94a4384f7cb26348f37c212a9f50f5bba76a
MD5 ea6464d6d81a30767f65c47b73f5b988
SHA1 f38587fec68976581efe64d4b554d515039e562c
SHA512 6756158769178ce39ebfb1039200bac7a75f0d1d54dbdc9f91609a905dea705151af4f12aab5a48c12f2bebd1ffeac4b7708a97ec8632ebbc4a643fa95556bd4
SSDEEP 3072:eaZxxKy1vCdAOa5ORinNfIgLQr0IkMipDZnuIUz:pLn1vCdAOaKinNQrpeln5Uz
TLSH
T1C8F30703D56720FEC1A9C6B4878BA632FA73B45C17746A8F1710CEA51F61AB0B73D606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor execution havoc

Malware Config

Signatures

Family: Havoc, HavocC2
Havoc is an open-source backdoor and post-exploitation framework written in C++.
backdoor havoc

Detects Havoc payload 2 IoCs

resource	yara_rule
behavioral2/memory/4980-188-0x00000189D5BA0000-0x00000189D5BBA000-memory.dmp	family_havoc
behavioral2/files/0x001d0000000167e7-198.dat	family_havoc

Command and Scripting Interpreter: PowerShell 1 TTPs 33 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2684	powershell.exe
5424	powershell.exe
4928	powershell.exe
2392	powershell.exe
1112	powershell.exe
3792	powershell.exe
932	powershell.exe
404	powershell.exe
3496	powershell.exe
2112	powershell.exe
3944	powershell.exe
4344	powershell.exe
4920	powershell.exe
2892	powershell.exe
6108	powershell.exe
4912	powershell.exe
2916	powershell.exe
4840	powershell.exe
2072	powershell.exe
4960	powershell.exe
636	powershell.exe
3536	powershell.exe
5056	powershell.exe
2564	powershell.exe
1328	powershell.exe
3460	powershell.exe
4344	powershell.exe
2396	powershell.exe
2440	powershell.exe
4756	powershell.exe
3320	powershell.exe
244	powershell.exe
5564	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2916	powershell.exe
2916	powershell.exe
5424	powershell.exe
5424	powershell.exe
4344	powershell.exe
4344	powershell.exe
4928	powershell.exe
4928	powershell.exe
2440	powershell.exe
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeIncreaseQuotaPrivilege	2916	powershell.exe
Token: SeSecurityPrivilege	2916	powershell.exe
Token: SeTakeOwnershipPrivilege	2916	powershell.exe
Token: SeLoadDriverPrivilege	2916	powershell.exe
Token: SeSystemProfilePrivilege	2916	powershell.exe
Token: SeSystemtimePrivilege	2916	powershell.exe
Token: SeProfSingleProcessPrivilege	2916	powershell.exe
Token: SeIncBasePriorityPrivilege	2916	powershell.exe
Token: SeCreatePagefilePrivilege	2916	powershell.exe
Token: SeBackupPrivilege	2916	powershell.exe
Token: SeRestorePrivilege	2916	powershell.exe
Token: SeShutdownPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeSystemEnvironmentPrivilege	2916	powershell.exe
Token: SeRemoteShutdownPrivilege	2916	powershell.exe
Token: SeUndockPrivilege	2916	powershell.exe
Token: SeManageVolumePrivilege	2916	powershell.exe
Token: 33	2916	powershell.exe
Token: 34	2916	powershell.exe
Token: 35	2916	powershell.exe
Token: 36	2916	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeIncreaseQuotaPrivilege	5424	powershell.exe
Token: SeSecurityPrivilege	5424	powershell.exe
Token: SeTakeOwnershipPrivilege	5424	powershell.exe
Token: SeLoadDriverPrivilege	5424	powershell.exe
Token: SeSystemProfilePrivilege	5424	powershell.exe
Token: SeSystemtimePrivilege	5424	powershell.exe
Token: SeProfSingleProcessPrivilege	5424	powershell.exe
Token: SeIncBasePriorityPrivilege	5424	powershell.exe
Token: SeCreatePagefilePrivilege	5424	powershell.exe
Token: SeBackupPrivilege	5424	powershell.exe
Token: SeRestorePrivilege	5424	powershell.exe
Token: SeShutdownPrivilege	5424	powershell.exe
Token: SeDebugPrivilege	5424	powershell.exe
Token: SeSystemEnvironmentPrivilege	5424	powershell.exe
Token: SeRemoteShutdownPrivilege	5424	powershell.exe
Token: SeUndockPrivilege	5424	powershell.exe
Token: SeManageVolumePrivilege	5424	powershell.exe
Token: 33	5424	powershell.exe
Token: 34	5424	powershell.exe
Token: 35	5424	powershell.exe
Token: 36	5424	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4344	powershell.exe
Token: SeSecurityPrivilege	4344	powershell.exe
Token: SeTakeOwnershipPrivilege	4344	powershell.exe
Token: SeLoadDriverPrivilege	4344	powershell.exe
Token: SeSystemProfilePrivilege	4344	powershell.exe
Token: SeSystemtimePrivilege	4344	powershell.exe
Token: SeProfSingleProcessPrivilege	4344	powershell.exe
Token: SeIncBasePriorityPrivilege	4344	powershell.exe
Token: SeCreatePagefilePrivilege	4344	powershell.exe
Token: SeBackupPrivilege	4344	powershell.exe
Token: SeRestorePrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeSystemEnvironmentPrivilege	4344	powershell.exe
Token: SeRemoteShutdownPrivilege	4344	powershell.exe
Token: SeUndockPrivilege	4344	powershell.exe
Token: SeManageVolumePrivilege	4344	powershell.exe
Token: 33	4344	powershell.exe
Token: 34	4344	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 5476	4980	OGFN Ext by Fr4nky.exe	88
PID 4980 wrote to memory of 2916	4980	OGFN Ext by Fr4nky.exe	91
PID 4980 wrote to memory of 4868	4980	OGFN Ext by Fr4nky.exe	94
PID 4980 wrote to memory of 3328	4980	OGFN Ext by Fr4nky.exe	96
PID 4980 wrote to memory of 3376	4980	OGFN Ext by Fr4nky.exe	98
PID 4980 wrote to memory of 6104	4980	OGFN Ext by Fr4nky.exe	100
PID 4980 wrote to memory of 244	4980	OGFN Ext by Fr4nky.exe	102
PID 4980 wrote to memory of 3624	4980	OGFN Ext by Fr4nky.exe	104
PID 4980 wrote to memory of 4484	4980	OGFN Ext by Fr4nky.exe	106
PID 4980 wrote to memory of 1532	4980	OGFN Ext by Fr4nky.exe	108
PID 4980 wrote to memory of 5116	4980	OGFN Ext by Fr4nky.exe	110
PID 4980 wrote to memory of 944	4980	OGFN Ext by Fr4nky.exe	112
PID 4980 wrote to memory of 5256	4980	OGFN Ext by Fr4nky.exe	114
PID 4980 wrote to memory of 5100	4980	OGFN Ext by Fr4nky.exe	208
PID 4980 wrote to memory of 1892	4980	OGFN Ext by Fr4nky.exe	118
PID 4980 wrote to memory of 5392	4980	OGFN Ext by Fr4nky.exe	150
PID 4980 wrote to memory of 5872	4980	OGFN Ext by Fr4nky.exe	122
PID 4980 wrote to memory of 3272	4980	OGFN Ext by Fr4nky.exe	155
PID 4980 wrote to memory of 5424	4980	OGFN Ext by Fr4nky.exe	126
PID 4980 wrote to memory of 4344	4980	OGFN Ext by Fr4nky.exe	267
PID 4980 wrote to memory of 4928	4980	OGFN Ext by Fr4nky.exe	130
PID 4980 wrote to memory of 2440	4980	OGFN Ext by Fr4nky.exe	132

C:\Users\Admin\AppData\Local\Temp\OGFN Ext by Fr4nky.exe
"C:\Users\Admin\AppData\Local\Temp\OGFN Ext by Fr4nky.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:5476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4868
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:3328
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:3376
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:6104
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:244
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:3624
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:4484
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:1532
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:5116
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:944
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:5256
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:5100
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1892
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:5392
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:5872
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2564
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4724
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4912
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:5392
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:1648
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:5928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3272
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:4696
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:916
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:1464
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:3112
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:2996
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:3380

C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
1⤵
PID:6016
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2684
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:5892
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4864
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:3376
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:2028
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:3320
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:6136
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:5100
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:5880
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:1716
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4696
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:4784
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4316
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:4964
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:1680
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:2720
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4912
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:2408
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:4592
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:2368
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4480
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:2372
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:3436
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:2804
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:2596
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:3316
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:3716
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:2864

C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe
"C:\ProgramData\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate1.exe" --no-startup-window --win-session-start
1⤵
PID:1904
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3792
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4472
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:3868
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:1144
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:4604
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1096
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:4428
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:1900
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:1532
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:4256
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:5756
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:1436
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:2436
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1076
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:2996
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:5768
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\EdgeUpdate'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\Downloads'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3536
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\System32\|*"
  2⤵
  PID:2480
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\SysWOW64\|*"
  2⤵
  PID:5476
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files\|*"
  2⤵
  PID:5356
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Program Files (x86)\|*"
  2⤵
  PID:6052
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\|*"
  2⤵
  PID:1416
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Public\|*"
  2⤵
  PID:2424
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Windows\Temp\|*"
  2⤵
  PID:5056
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\Admin\AppData\Local\Temp\|*"
  2⤵
  PID:468
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\|*"
  2⤵
  PID:5380
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\Windows\|*"
  2⤵
  PID:1388
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\ProgramData\Microsoft\EdgeUpdate\|*"
  2⤵
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...