phemedrone | 8664e6d9a120c7eedb3cd40f9e1a16a594cc6bf099b38b6d93181b4469fb9175

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2024 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

launcher.exe
Size

291KB
MD5

11501a69ddf54287446e4cffa4d268a3
SHA1

09bab84093ed44ec38bc240459c9e1905762110f
SHA256

8664e6d9a120c7eedb3cd40f9e1a16a594cc6bf099b38b6d93181b4469fb9175
SHA512

bb7990605ef8c5419cfbf05cb16dd03c1c7b0ea95ca179e8abb8aff99df50fc15e4231ba98e82204d704880b6476b92212d0b3a2e9dbffe56e8b480b80554c5d
SSDEEP

6144:K8emLf5K/nSiKWiB3XjdOwkL1xOivj0MW1WQ9mLtf6TUIa1bq/KMw:HeAxKPPiB3zEjLPl0MWkf6J

Score

10^/10

phemedrone xworm execution rat stealer trojan

Malware Config

Extracted

Family

phemedrone

https://api.telegram.org/bot7093178471:AAF2vSzsv_7VHw_mw-hRkrEjGXZZ0VRp1-c/sendDocument

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000234cd-35.dat	family_xworm
behavioral1/memory/1420-42-0x00000000000C0000-0x00000000000D6000-memory.dmp	family_xworm

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe
4788	powershell.exe
4924	powershell.exe
5008	powershell.exe
464	powershell.exe
1480	powershell.exe
4856	powershell.exe
2912	powershell.exe
1976	powershell.exe
2036	powershell.exe
3004	powershell.exe
2324	powershell.exe
2000	powershell.exe
4932	powershell.exe
880	powershell.exe
376	powershell.exe
400	powershell.exe
2972	powershell.exe
5112	powershell.exe
2396	powershell.exe
5108	powershell.exe
3648	powershell.exe
4972	powershell.exe
2168	powershell.exe
1580	powershell.exe
4304	powershell.exe
1464	powershell.exe
5056	powershell.exe
3376	powershell.exe
392	powershell.exe
4980	powershell.exe
3728	powershell.exe
444	powershell.exe
4528	powershell.exe
2552	powershell.exe
1124	powershell.exe
4696	powershell.exe
4492	powershell.exe
768	powershell.exe
1612	powershell.exe
60	powershell.exe
232	powershell.exe
220	powershell.exe
3608	powershell.exe
4788	powershell.exe
2088	powershell.exe
4308	powershell.exe
4692	powershell.exe
1200	powershell.exe
5116	powershell.exe
4884	powershell.exe
1064	powershell.exe
2716	powershell.exe
2076	powershell.exe
2356	powershell.exe
4992	powershell.exe
1080	powershell.exe
1504	powershell.exe
4580	powershell.exe
2016	powershell.exe
1816	powershell.exe
720	powershell.exe
4728	powershell.exe
4376	powershell.exe

Checks computer location settings 2 TTPs 47 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	launcher.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 64 IoCs

pid	Process
1420	msedge.exe
1512	Otupevi.exe
3888	msedge.exe
5112	Otupevi.exe
2076	msedge.exe
4460	Otupevi.exe
4816	msedge.exe
1512	Otupevi.exe
3112	msedge.exe
2980	Otupevi.exe
5060	msedge.exe
624	Otupevi.exe
3308	msedge.exe
4712	Otupevi.exe
664	msedge.exe
1416	Otupevi.exe
4516	msedge.exe
2860	Otupevi.exe
552	msedge.exe
400	msedge.exe
4396	Otupevi.exe
1720	msedge.exe
1604	Otupevi.exe
2728	msedge.exe
1248	Otupevi.exe
1504	msedge.exe
5016	Otupevi.exe
512	msedge.exe
3580	Otupevi.exe
1044	msedge.exe
5016	Otupevi.exe
2052	msedge.exe
4548	Otupevi.exe
4696	msedge.exe
4780	Otupevi.exe
1824	msedge.exe
2864	Otupevi.exe
2352	msedge.exe
3640	Otupevi.exe
4396	msedge.exe
5096	Otupevi.exe
2680	msedge.exe
2632	Otupevi.exe
1872	msedge.exe
3560	Otupevi.exe
2884	msedge.exe
1104	Otupevi.exe
1844	msedge.exe
4208	Otupevi.exe
224	msedge.exe
680	Otupevi.exe
3464	msedge.exe
4924	Otupevi.exe
4472	msedge.exe
3800	Otupevi.exe
2448	msedge.exe
2720	Otupevi.exe
3968	msedge.exe
2424	msedge.exe
4856	Otupevi.exe
2076	msedge.exe
2436	Otupevi.exe
5020	msedge.exe
1532	Otupevi.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com
33	ip-api.com
61	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
60	powershell.exe
60	powershell.exe
2744	powershell.exe
2744	powershell.exe
1816	powershell.exe
1816	powershell.exe
4460	powershell.exe
4460	powershell.exe
2064	powershell.exe
2064	powershell.exe
392	powershell.exe
392	powershell.exe
5108	powershell.exe
5108	powershell.exe
1580	powershell.exe
1064	powershell.exe
1064	powershell.exe
1580	powershell.exe
3000	powershell.exe
1104	powershell.exe
1104	powershell.exe
3000	powershell.exe
2000	powershell.exe
2000	powershell.exe
3836	powershell.exe
3836	powershell.exe
2608	powershell.exe
2608	powershell.exe
864	powershell.exe
864	powershell.exe
720	powershell.exe
720	powershell.exe
2088	powershell.exe
2088	powershell.exe
4248	powershell.exe
4248	powershell.exe
1976	powershell.exe
1976	powershell.exe
540	powershell.exe
540	powershell.exe
232	powershell.exe
232	powershell.exe
1124	powershell.exe
1124	powershell.exe
5008	powershell.exe
5008	powershell.exe
1872	powershell.exe
1872	powershell.exe
464	powershell.exe
464	powershell.exe
4980	powershell.exe
4980	powershell.exe
4304	powershell.exe
4304	powershell.exe
220	powershell.exe
220	powershell.exe
2608	powershell.exe
2608	powershell.exe
2036	powershell.exe
2036	powershell.exe
1080	powershell.exe
1080	powershell.exe
4304	powershell.exe
4304	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	launcher.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	1420	msedge.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	4256	launcher.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	3888	msedge.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	3984	launcher.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	2076	msedge.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	2208	launcher.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1420	msedge.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	4816	msedge.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	2304	launcher.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	3112	msedge.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	3004	launcher.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	5060	msedge.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3176	launcher.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	3308	msedge.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	1072	launcher.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	664	msedge.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	2084	launcher.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	4516	msedge.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1328	launcher.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	552	msedge.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	400	msedge.exe
Token: SeDebugPrivilege	1504	launcher.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	1720	msedge.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	2640	launcher.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 60	1248	launcher.exe	83
PID 1248 wrote to memory of 60	1248	launcher.exe	83
PID 1248 wrote to memory of 4256	1248	launcher.exe	85
PID 1248 wrote to memory of 4256	1248	launcher.exe	85
PID 1248 wrote to memory of 2744	1248	launcher.exe	86
PID 1248 wrote to memory of 2744	1248	launcher.exe	86
PID 1248 wrote to memory of 1420	1248	launcher.exe	88
PID 1248 wrote to memory of 1420	1248	launcher.exe	88
PID 1248 wrote to memory of 1816	1248	launcher.exe	89
PID 1248 wrote to memory of 1816	1248	launcher.exe	89
PID 1248 wrote to memory of 1512	1248	launcher.exe	91
PID 1248 wrote to memory of 1512	1248	launcher.exe	91
PID 4256 wrote to memory of 4460	4256	launcher.exe	98
PID 4256 wrote to memory of 4460	4256	launcher.exe	98
PID 4256 wrote to memory of 3984	4256	launcher.exe	100
PID 4256 wrote to memory of 3984	4256	launcher.exe	100
PID 4256 wrote to memory of 2064	4256	launcher.exe	101
PID 4256 wrote to memory of 2064	4256	launcher.exe	101
PID 4256 wrote to memory of 3888	4256	launcher.exe	103
PID 4256 wrote to memory of 3888	4256	launcher.exe	103
PID 4256 wrote to memory of 392	4256	launcher.exe	104
PID 4256 wrote to memory of 392	4256	launcher.exe	104
PID 4256 wrote to memory of 5112	4256	launcher.exe	106
PID 4256 wrote to memory of 5112	4256	launcher.exe	106
PID 3984 wrote to memory of 5108	3984	launcher.exe	110
PID 3984 wrote to memory of 5108	3984	launcher.exe	110
PID 3984 wrote to memory of 2208	3984	launcher.exe	112
PID 3984 wrote to memory of 2208	3984	launcher.exe	112
PID 1420 wrote to memory of 1580	1420	msedge.exe	113
PID 1420 wrote to memory of 1580	1420	msedge.exe	113
PID 3984 wrote to memory of 1064	3984	launcher.exe	115
PID 3984 wrote to memory of 1064	3984	launcher.exe	115
PID 3984 wrote to memory of 2076	3984	launcher.exe	117
PID 3984 wrote to memory of 2076	3984	launcher.exe	117
PID 1420 wrote to memory of 1104	1420	msedge.exe	118
PID 1420 wrote to memory of 1104	1420	msedge.exe	118
PID 3984 wrote to memory of 3000	3984	launcher.exe	120
PID 3984 wrote to memory of 3000	3984	launcher.exe	120
PID 3984 wrote to memory of 4460	3984	launcher.exe	122
PID 3984 wrote to memory of 4460	3984	launcher.exe	122
PID 1420 wrote to memory of 2000	1420	msedge.exe	123
PID 1420 wrote to memory of 2000	1420	msedge.exe	123
PID 1420 wrote to memory of 3836	1420	msedge.exe	127
PID 1420 wrote to memory of 3836	1420	msedge.exe	127
PID 2208 wrote to memory of 2608	2208	launcher.exe	131
PID 2208 wrote to memory of 2608	2208	launcher.exe	131
PID 1420 wrote to memory of 5060	1420	msedge.exe	133
PID 1420 wrote to memory of 5060	1420	msedge.exe	133
PID 2208 wrote to memory of 2304	2208	launcher.exe	135
PID 2208 wrote to memory of 2304	2208	launcher.exe	135
PID 2208 wrote to memory of 864	2208	launcher.exe	136
PID 2208 wrote to memory of 864	2208	launcher.exe	136
PID 2208 wrote to memory of 4816	2208	launcher.exe	138
PID 2208 wrote to memory of 4816	2208	launcher.exe	138
PID 2208 wrote to memory of 720	2208	launcher.exe	139
PID 2208 wrote to memory of 720	2208	launcher.exe	139
PID 2208 wrote to memory of 1512	2208	launcher.exe	141
PID 2208 wrote to memory of 1512	2208	launcher.exe	141
PID 2304 wrote to memory of 2088	2304	launcher.exe	144
PID 2304 wrote to memory of 2088	2304	launcher.exe	144
PID 2304 wrote to memory of 3004	2304	launcher.exe	146
PID 2304 wrote to memory of 3004	2304	launcher.exe	146
PID 2304 wrote to memory of 4248	2304	launcher.exe	147
PID 2304 wrote to memory of 4248	2304	launcher.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:60
- C:\Users\Admin\AppData\Local\Temp\launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- - C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
      4⤵
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        6⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        8⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        10⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        12⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        13⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        13⤵
        Checks computer location settings
        
        PID:4008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        14⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        14⤵
        Checks computer location settings
        
        PID:2032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        15⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        15⤵
        Checks computer location settings
        
        PID:540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        16⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        16⤵
        Checks computer location settings
        
        PID:3464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        17⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        17⤵
        Checks computer location settings
        
        PID:3644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        18⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        18⤵
        Checks computer location settings
        
        PID:4288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        19⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        19⤵
        Checks computer location settings
        
        PID:1516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        20⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        20⤵
        Checks computer location settings
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        21⤵
        Checks computer location settings
        
        PID:4940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        22⤵
        Checks computer location settings
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        23⤵
        Checks computer location settings
        
        PID:3132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        24⤵
        Checks computer location settings
        
        PID:3684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        25⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        25⤵
        Checks computer location settings
        
        PID:5008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        26⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        26⤵
        Checks computer location settings
        
        PID:1720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        27⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        27⤵
        Checks computer location settings
        
        PID:4100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        28⤵
        Checks computer location settings
        
        PID:4692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        29⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        29⤵
        Checks computer location settings
        
        PID:4104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        30⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        30⤵
        Checks computer location settings
        
        PID:3392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        31⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        31⤵
        Checks computer location settings
        
        PID:2308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        32⤵
        Checks computer location settings
        
        PID:4704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        33⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        33⤵
        Checks computer location settings
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        34⤵
        Checks computer location settings
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        35⤵
        Checks computer location settings
        
        PID:1796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        36⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        36⤵
        Checks computer location settings
        
        PID:3968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        37⤵
        Checks computer location settings
        
        PID:540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        38⤵
        Checks computer location settings
        
        PID:5040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        39⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        39⤵
        Checks computer location settings
        
        PID:3552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        40⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        40⤵
        Checks computer location settings
        
        PID:2064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        41⤵
        Checks computer location settings
        
        PID:4040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        42⤵
        Checks computer location settings
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        43⤵
        
        PID:180
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        43⤵
        Checks computer location settings
        
        PID:1208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        44⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        44⤵
        Checks computer location settings
        
        PID:372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        45⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        45⤵
        Checks computer location settings
        
        PID:460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        46⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        46⤵
        Checks computer location settings
        
        PID:4292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\launcher.exe'
        47⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\launcher.exe
        
        "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
        47⤵
        
        PID:4040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        47⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        47⤵
        
        PID:3020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        47⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        47⤵
        
        PID:3160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        46⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        46⤵
        
        PID:5096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        46⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        46⤵
        
        PID:5020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        45⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        45⤵
        
        PID:4436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        45⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        45⤵
        
        PID:2704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        44⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        44⤵
        
        PID:3568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        44⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        44⤵
        
        PID:1608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        43⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        43⤵
        
        PID:3728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        43⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        43⤵
        
        PID:4432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        42⤵
        
        PID:1940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        42⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        42⤵
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        41⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        41⤵
        
        PID:2608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        41⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        41⤵
        
        PID:2156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        40⤵
        
        PID:2376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        40⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        40⤵
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        39⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        39⤵
        
        PID:940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        39⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        39⤵
        
        PID:2548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        38⤵
        
        PID:2732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        38⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        38⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        37⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        37⤵
        
        PID:4328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        37⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        37⤵
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        36⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        36⤵
        
        PID:2980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        36⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        36⤵
        
        PID:4268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        35⤵
        
        PID:1136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        35⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        34⤵
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        34⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        34⤵
        
        PID:4516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        33⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        33⤵
        
        PID:5100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        33⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        33⤵
        
        PID:4248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        32⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        32⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        32⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        32⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        31⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        31⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        31⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        31⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        30⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        30⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        30⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        29⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        29⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        29⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        29⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        28⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        28⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        28⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        27⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        27⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        27⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        27⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        26⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        26⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        26⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        26⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        25⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        25⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        25⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        25⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        24⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        24⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        24⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        24⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        23⤵
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        23⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        23⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        22⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        22⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        21⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        21⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        21⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        20⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        20⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        19⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        19⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        19⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        19⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        18⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        18⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        18⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        17⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        17⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        17⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        17⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        16⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        16⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        16⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        16⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        15⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        15⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        15⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        15⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        14⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        14⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        14⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        13⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        13⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        13⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        13⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        12⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        12⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        11⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        10⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        9⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        8⤵
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        7⤵
        Executes dropped EXE
        
        PID:624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        6⤵
        Executes dropped EXE
        
        PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\msedge.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
        5⤵
        Executes dropped EXE
        
        PID:1512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\msedge.exe
      "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
      "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
      4⤵
      Executes dropped EXE
      PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\msedge.exe
    "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
    "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
    3⤵
    - Executes dropped EXE
    PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\msedge.exe
  "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msedge.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\msedge.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Otupevi.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\Otupevi.exe
  "C:\Users\Admin\AppData\Local\Temp\Otupevi.exe"
  2⤵
  - Executes dropped EXE
  PID:1512

C:\Users\Admin\msedge.exe
C:\Users\Admin\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Users\Admin\msedge.exe
C:\Users\Admin\msedge.exe
1⤵
- Executes dropped EXE
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\launcher.exe.log

Filesize
1KB

MD5
bb6a89a9355baba2918bb7c32eca1c94

SHA1
976c76dfbc072e405ce0d0b9314fe5b9e84cb1b2

SHA256
192fbb7f4d1396fd4846854c5472a60aa80932f3c754f2c2f1a2a136c8a6bb4b

SHA512
efdf0c6228c3a8a7550804ac921dfefc5265eb2c9bbf4b8b00cedd427c0a5adf610586b844ff444bd717abff138affcbe49632ce984cbffc5fa8019b4ba6ec0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
da5c82b0e070047f7377042d08093ff4

SHA1
89d05987cd60828cca516c5c40c18935c35e8bd3

SHA256
77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

SHA512
7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9c740b7699e2363ac4ecdf496520ca35

SHA1
aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

SHA256
be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

SHA512
8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10fb30dc297f99d6ebafa5fee8b24fa2

SHA1
76904509313a49a765edcde26b69c3a61f9fa225

SHA256
567bcacac120711fc04bf8e6c8cd0bff7b61e8ee0a6316254d1005ebb1264e6a

SHA512
c42ace1ea0923fa55592f4f486a508ea56997fdbe0200016b0fc16a33452fc28e4530129a315b3b3a5ede37a07097c13a0eb310c9e91e5d97bb7ce7b955b9498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
15dde0683cd1ca19785d7262f554ba93

SHA1
d039c577e438546d10ac64837b05da480d06bf69

SHA256
d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

SHA512
57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef72c47dbfaae0b9b0d09f22ad4afe20

SHA1
5357f66ba69b89440b99d4273b74221670129338

SHA256
692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

SHA512
7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3161f4edbc9b963debe22e29658050b

SHA1
45dbf88dadafe5dd1cfee1e987c8a219d3208cdb

SHA256
1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a

SHA512
006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a7cc007980e419d553568a106210549a

SHA1
c03099706b75071f36c3962fcc60a22f197711e0

SHA256
a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

SHA512
b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f9246b90bb643f1f6e32b638684da6e

SHA1
7c3d0a783c969d3a55eb92669bd9183f0b7dd603

SHA256
4ac95bd39341c98026937c0fc18142ed1d3f034f5073c9b03defdfa1c9be8bad

SHA512
57285dcf7c0e0a0f477e3f6ff1aca9223785c221d899a74c02aa8f82619d1d1914562682a85dd4b4fadb25c95d98f016d76bb3c8049d38d8de8fa14db194110d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5bebad5b54fab3fe0a41b565bdfc22f5

SHA1
55eb1edbcd70473e8e8665597104e41131ef2dad

SHA256
fa22d2f9d8c4ce14fb56bdd809ca2a2d656b19a3da49c32d9551696dd8a23251

SHA512
4a894cccaf8e1d6f1f5d39e72cd5c6bd66bd99c0a5df23b6e3a9344e5b6debf33f281440ca4c0cddf2349cba762177a9b867455141d4a8c64165cee20f51a1e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
b51dc9e5ec3c97f72b4ca9488bbb4462

SHA1
5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

SHA256
976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

SHA512
0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
60945d1a2e48da37d4ce8d9c56b6845a

SHA1
83e80a6acbeb44b68b0da00b139471f428a9d6c1

SHA256
314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3

SHA512
5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a1008cfb29cdc25b4180c736ec404335

SHA1
39760fbcc8c1a64e856e98d61ce194d39b727438

SHA256
0eb4209b0f8c0dce02580b4d3ec5692d33be08b1a61858aad0413116afc95558

SHA512
00c2cde1601217c28fd71c2daefb21c7fcfeeee7e6badcd1b7f353f4e6df7817f5c4665148a1468b10ea31547642b999e3db5914d6e5f0cb1123243fd9ef213f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4165c906a376e655973cef247b5128f1

SHA1
c6299b6ab8b2db841900de376e9c4d676d61131e

SHA256
fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

SHA512
15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0b72469ca0585278ca9c240a42085ad7

SHA1
dd0371aab5740e6d5f44d75f02f5f2d0a16089b2

SHA256
9e9693e3e021a1a0aeac855d0c2fd330568225282ed4e2d8ea1d876457efa0db

SHA512
77929ab5f47ec18e78e9e57f0cb9a41dd02e8974b59f692175fefdd69a6e84c6c289a8e4cb563fb064857f2c3cf6ce330e8efa7dcb352691fdbd662c90c3b577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ce4540390cc4841c8973eb5a3e9f4f7d

SHA1
2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

SHA256
e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

SHA512
2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3952e58e5b0dc4ca85530346cab31745

SHA1
b40f8e12c28260dc66b36978ffd82f9238f78e8e

SHA256
3683911c627d789d95c19767391431323b5232ff2701686955012108acbe9f4f

SHA512
c8cab56b5995c4346cddfa52485de4eb8aca345b1b683cad808dfaaf6a665b3fe8141b6fb82838df64587c2390bd6acfb179b150638bdf9654d4ecb4567c4ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96e3b86880fedd5afc001d108732a3e5

SHA1
8fc17b39d744a9590a6d5897012da5e6757439a3

SHA256
c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294

SHA512
909b1968f7204fa7029109b02232d8cc5438f6b4dc7c9044e4e47c59fcee538199b13029e36592b12ed573d48a308dd4822d2ced4129ab08d4111897e02be55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
fd98baf5a9c30d41317663898985593b

SHA1
ea300b99f723d2429d75a6c40e0838bf60f17aad

SHA256
9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

SHA512
bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd41d9e85ce4c2fb194d6fd51ad735e9

SHA1
0e289f94ca12b8477161d52a205f419b7d48b9f4

SHA256
34c4bd5e1fb75db7572e3d7e083c83be356fd3f91a6f7bfd029757fd0471f91d

SHA512
97a44d637bf29b3f0f9d04dc8d5be68283f719303de3a7d3b4b483381e21e1feae798e1c622e1040b70ab266e389a68aad9ced42511dd9f9b998cfce8ef27dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Otupevi.exe

Filesize
121KB

MD5
8ec6238ed8d4909bdde76b64fb9d1e7f

SHA1
5b8fcf12943eb425e47ba2e09a760a465fde9085

SHA256
cecbc104cfe47d1488d61b4e23b518476f194122539965c20309aa01067712b5

SHA512
75281075f3732c1ba70fc0a372facd8714d14bf4a7c7fbce16d3fb51fdcaf2fc5207a769ef109e836e2d4946b42a444f571cbc4349a6444b0f2387d028accebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1s50oxfr.j2s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge.exe

Filesize
64KB

MD5
2c3e1012f82fbe50509db62017302567

SHA1
0c3bcdf9a21e0a2505942cfd5f53279f89acb885

SHA256
8a59d37451b5a84dc78c9bef33a183128e48e02367b0ffa786965b41ca1f2237

SHA512
77d921b91a646e708555107705f32d55eedfb3b5298be889a7c0f0d9d02b6e3483de7ff147db4c71c571fe366224cdc5e98a89b14df831197d63d9a9a6bb1f43

Download Submit
memory/60-15-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/60-14-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/60-13-0x0000024875AA0000-0x0000024875AC2000-memory.dmp

Filesize
136KB

Download
memory/60-18-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/60-3-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/1248-1-0x00000000001E0000-0x000000000022E000-memory.dmp

Filesize
312KB

Download
memory/1248-0-0x00007FF810C13000-0x00007FF810C15000-memory.dmp

Filesize
8KB

Download
memory/1248-2-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/1248-67-0x00007FF810C10000-0x00007FF8116D1000-memory.dmp

Filesize
10.8MB

Download
memory/1420-42-0x00000000000C0000-0x00000000000D6000-memory.dmp

Filesize
88KB

Download
memory/1512-66-0x0000000000D90000-0x0000000000DB4000-memory.dmp

Filesize
144KB

Download