Overview

overview

8

Static

static

3

Прило...а.exe

windows10-2004-x64

8

Прило...а.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/09/2026, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Приложение для подсчета.exe
  • Size 30.1MB
  • Sample260908-3avkfaaa45
  • SHA256 f470d775b1ad4937f434723b2364d6e40fda461e740eda74780b0a8394351a18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 59 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 53 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Приложение для подсчета.exe
    "C:\Users\Admin\AppData\Local\Temp\Приложение для подсчета.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Users\Admin\AppData\Local\Temp\Приложение для подсчета.exe
      "C:\Users\Admin\AppData\Local\Temp\Приложение для подсчета.exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2424
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:836
      • C:\Windows\explorer.exe
        explorer.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:840
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4204
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3476
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4424
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4340
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3548
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:452
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2452
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4320
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3472
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3348
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2408
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3480
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4468
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4080
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2796
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3728
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:608
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3340
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:416
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3660
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3148
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1544
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:780
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1584
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3944
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -Command " [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null [Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null $Template = @\" <toast duration=\"short\"> <visual> <binding template=\"ToastImageAndText02\"> <image id=\"1\" src=\"\" /> <text id=\"1\"><![CDATA[Windows Security]]></text> <text id=\"2\"><![CDATA[Virus & threat protection Threats found Microsoft Defender Antivirus found threats. Get details.]]></text> </binding> </visual> <actions> </actions> <audio silent=\"true\" /> </toast> \"@ $SerializedXml = New-Object Windows.Data.Xml.Dom.XmlDocument $SerializedXml.LoadXml($Template) $Toast = [Windows.UI.Notifications.ToastNotification]::new($SerializedXml) $Toast.Tag = \"Windows Security\" $Toast.Group = \"Windows Security\" $Notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier(\"Windows Security\") $Notifier.Show($Toast); "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1528
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2060
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 5ebacd6ee97e90cd3e6b896ecd9040a9edf00497f4554b7bbf62f7d83a094745
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 ce8919c2f373fbeb62d6ecae9ab255bbeb265be6f3a8f58716dcafe04fda9ccb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AppCache134333832022419768.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134333832022419768.txt
        • Size 79KB
        • SHA256 d45a3ae2591c918c16aa2cd940afa2e53fbd89699a0605f12520c0e688b5eef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CortanaUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
        • Size 18KB
        • SHA256 22597c569884136a88191249f554b6280ea7e60e97ee313d70f21edbace6fdde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_bz2.pyd
        • Size 84KB
        • SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_ctypes.pyd
        • Size 131KB
        • SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_lzma.pyd
        • Size 155KB
        • SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 e756f6970905657cf73ecb3f57bae55a67be29afa75ae4d16046b0f7229708eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 4e08856ff5203592c27f943f5586d2214b7c5dacde1b1ef75c2316590ab788c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 e83d5e5eb772070999f34a214ebffcf0a6068ebc1c4b4f1991188448f323808d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 45afaf08d1cd7e43ac5ded47ed5fd708b86e835a9470c81e8130ed6955b84db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-fibers-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 83ecd4fc05c5603621ab687657b8862175025c9910f8dc1b23135d2350dd9219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 f73000652ca7ca7468ca6134663c99cbaf7bd97740bdbdd5d1e1e23ccfd5db75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 b153ff5d667c8297776f21c5f440cff28c3e3a5b1f748fd4700306e1fb283ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-file-l2-1-0.dll
        • Size 20KB
        • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 2783b85d98f4a92faf67a94fc04e9c2f6786627949984828d14deab1682bbe3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 6d14b49e8e21de08b9fa778f15c259dbd4feb9b54eb628d69bd50e5c86aa65a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 22cf7040d9cb3dc79d941a6bbe4cebd5beaa1355d6e424843e6970404281e61e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 425e4ebee71347295e36776d415611d451e2a51b451df57da23ed8f8fb4664e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 e4011458af1397e26d0b233cbb2fa661faa6dae7b7a9541e9311c8af1ecb5e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 9c5ea7a7e943c65da3aeff4da33b47fc4a3becea2f7a0b6aa2b632cd6d8b4632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 245cf5d5abc866d5ce327c4a1524ae3954ccfc9a7284c817fa15962695e6b6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 3add350dcd79c64a98e47adf733f26c9fdf47df097b060f04f067cdaf32e99cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 42f88e44e488a74af796e8c2a2548879764a40e554f35d1deb8eaff5def09e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 5c566535a9ac607fa99a665ab246ffb78767995dde86c4a9a5c518dd22b76e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 cac8fb2938ed80bd7eed42e3c68dead6cb41c30cfb567f23085986422f1a2747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 02fd3b0adf86967b6fc133797c12fa9ee8d0cf64778b5ca937b56e86ac726343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 c9103f6afdd8a6fea734da372911b0a3b018a84e00675a9355ea6f091e641781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 882edcaa7b39dc9e330d1b3dcb2a770be2404d6358d76cf4cf5e52231bedac60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 2d04920e410d81e3a044a76724a23cf892b23a5b382fb079abd6f689199c7428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 e92ce06aa782a4e50a5bc95da5ac5ded0dc3da7e1152078002a12367aa7cc1af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 bd4e40b2f5d0f60feceeb7622166e1a61fb34ac2cd5484e1d9826c7cffa3029c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 edd387b01cb9d85a44e27e656e5ea6898b8e9604682db29cb87ee3236f3a1d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 bf651fcd0f10dc528caa3168abd6ea528458c78aaa75b93b3c615d5a18567192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 1f818ccd44865c7c91c1ee5df7d21dc17840601d7470c0d1a486c5874304edd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 b84f44a882b2caa6d0bc3c01e8d012e881324b800fd39e2728fecdc65315a245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 d9fc17ce5dd5aecac0dca2d9a17a20271a13f68cd6cfa89163d72904a72f6b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 d7fab15f2d1298a11822ce5c7756da2eab1112bd3561b22db6b25a5a8acafad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 31fc3b5665c3bb2006496b5cbb0e5667b186263a867dbe5a760a996305f4f514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 98e8728908f2872819728e709291529bac39751dec7d01c03a175c4688b9c233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-private-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-private-l1-1-0.dll
        • Size 73KB
        • SHA256 c6dd4d812b5132a5b4e56598dabd5a76b8495b8a3f4b47ce16c6365c0e87436c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 a7433b9f8965f914da00dda4ede62d4db69f561a548cbc8d312293d0917a33c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 1d7d6e883472eb5ddafe383adbaa5f8ed7b9d6267e7ade971bbff47ec4b47935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 1516552690d6a38d65a8016d889f2ce1515649be6a45ef82cbed08a73690a7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 9636be82c51d61dd990504d786fac0d51d41f73d22700a18d4fbbfcf6da5dff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 554b506ca648507f10eeb5bae124ff91594f5fdd81d33b0171334be7ad5c7816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\api-ms-win-crt-utility-l1-1-0.dll
        • Size 21KB
        • SHA256 a7f53b76e7ea837f45bdb8712a864fb0c427c5eb863d155a72b422b96417ea10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\base_library.zip
        • Size 1.3MB
        • SHA256 d960a3738112b22104fb7244be98a47805786ab243d11f7c15d2511549afd639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freetype.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\freetype.dll
        • Size 639KB
        • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libjpeg-9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libjpeg-9.dll
        • Size 238KB
        • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libmodplug-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libmodplug-1.dll
        • Size 259KB
        • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libogg-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libogg-0.dll
        • Size 25KB
        • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libopus-0.dll
        • Size 359KB
        • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\python3.DLL
        • Size 70KB
        • SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\python313.dll
        • Size 5.8MB
        • SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_s5ho42lk.1xi.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5ho42lk.1xi.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/840-1219-0x0000000004C50000-0x0000000004C51000-memory.dmp
        Download

        memory/2040-1221-0x000001BB72F00000-0x000001BB73000000-memory.dmp
        Download

        memory/2040-1468-0x000001B371200000-0x000001B372B2F000-memory.dmp
        Download

        memory/2040-1220-0x000001BB72F00000-0x000001BB73000000-memory.dmp
        Download

        memory/2040-1225-0x000001BB73ED0000-0x000001BB73EF0000-memory.dmp
        Download

        memory/2040-1222-0x000001BB72F00000-0x000001BB73000000-memory.dmp
        Download

        memory/2040-1241-0x000001BB73E90000-0x000001BB73EB0000-memory.dmp
        Download

        memory/2040-1256-0x000001BB742A0000-0x000001BB742C0000-memory.dmp
        Download

        memory/2040-1439-0x000001B371200000-0x000001B372B2F000-memory.dmp
        Download

        memory/2396-1183-0x00007FFBF9840000-0x00007FFBF9AAC000-memory.dmp
        Download

        memory/2396-1151-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/2396-1152-0x00007FFBF9840000-0x00007FFBF9AAC000-memory.dmp
        Download

        memory/2852-1619-0x00000244D7740000-0x00000244D788E000-memory.dmp
        Download

        memory/3460-1153-0x0000026A31980000-0x0000026A31990000-memory.dmp
        Download

        memory/3460-1154-0x0000026A31980000-0x0000026A31990000-memory.dmp
        Download

        memory/3460-1164-0x0000026A31E70000-0x0000026A31E78000-memory.dmp
        Download

        memory/3460-1155-0x0000026A31B00000-0x0000026A31B22000-memory.dmp
        Download

        memory/3460-1163-0x0000026A31E40000-0x0000026A31E4A000-memory.dmp
        Download

        memory/3480-1628-0x000001F76EB40000-0x000001F76EC8E000-memory.dmp
        Download