MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 4792)
SUSPICIOUS
No suspicious indicators.
INFO
Application launched itself
Checks supported languages
- identity_helper.exe (PID: 7364)
- TextInputHost.exe (PID: 7620)
Reads the computer name
- identity_helper.exe (PID: 7364)
- TextInputHost.exe (PID: 7620)
Reads Microsoft Office registry keys
Reads Environment values
- identity_helper.exe (PID: 7364)
Checks proxy server information
Reads the software policy settings
The process uses the downloaded file
Manual execution by a user
- powershell.exe (PID: 4792)
- cmd.exe (PID: 7300)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 4792)