Harmony Endpoint Forensics Analysis: Content Details

SCRIPT & SHORTCUT CONTENT

ANDRE: a1bab5c7-166a-466d-9226-e37d9eb3c369

This view is used to display AMSI, WmiGet, Powershell, Shortcut and other content that was part of the incident. Click on the row of interest to view its contents.

Search:

File/Process Name	Args	Type
powershell.exe (10108)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (10108)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (10580)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (10580)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (10580)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (11620)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (11620)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (11620)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (12732)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (12732)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (1892)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (1892)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (1892)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (2072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (2072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (2072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (2264)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (2264)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (2264)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (5700)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (5700)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (5700)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (6216)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (6216)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (6216)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (7348)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (7348)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (7348)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (7844)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (7844)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (8128)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (8128)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (8128)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (8880)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (8880)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (8880)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (9072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (9072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (9072)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell
powershell.exe (944)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	AMSI
powershell.exe (944)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	WmiGet
powershell.exe (944)	-NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -	Powershell

AMSI content for: powershell.exe (10108)

$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens

------------------------------------------------------------------------------------------------------------------------------
exit