asyncrat | b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d

Analysis

max time kernel
150s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
Size 210KB
Sample260811-dsrttsvbrf
SHA256 b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d
MD5 5d8421027847620b57234b959ea986f9
SHA1 3b081b5a078fd6f948b769eb0bedd5c9217e8f8d
SHA512 d132e28bbd814c5b4132a86a0a65d8791f417e7b4a1e63154369aca97b985b83977830f6e93cbd9f0b3619c984a7666ee00031ceccd96321e611082ae2bc01c4
SSDEEP 3072:aFB+/0KRDKDb21OF8WxnZESKWI/9fGRUGKXs+S++7KFSbxeY+qDDrM:aFB+/0KNKDb22lnZEVv9XGqStKEbxI
TLSH
T109249E2D5E8AF89BD41419B55C77EAD10A6CEF99F0A1169834F8FF3CB7928708610F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion execution asyncrat donutloader loader persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

RrN9Ys9mXk5D

Attributes

delay
3
install
false
install_folder
%AppData%
private_ip
192.168.1.10

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4424-50-0x000001F95AD20000-0x000001F95AD32000-memory.dmp	family_asyncrat
behavioral2/memory/4380-136-0x0000014BB0FF0000-0x0000014BB1002000-memory.dmp	family_asyncrat
behavioral2/memory/4380-135-0x0000014BB0FF0000-0x0000014BB1002000-memory.dmp	family_asyncrat
behavioral2/memory/4380-226-0x0000014BB3FF0000-0x0000014BB4002000-memory.dmp	family_asyncrat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4424-46-0x000001F942930000-0x000001F942943000-memory.dmp	family_donutloader

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wslzsqpm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2624	powershell.exe
6568	powershell.exe
3512	powershell.exe
3964	powershell.exe
1940	powershell.exe
6324	powershell.exe
5944	powershell.exe
4292	powershell.exe
2324	powershell.exe
6936	powershell.exe
6652	powershell.exe
2552	powershell.exe
5644	powershell.exe
4644	powershell.exe
1180	powershell.exe
5060	powershell.exe
2604	powershell.exe
5004	powershell.exe
5592	powershell.exe
3484	powershell.exe
1396	powershell.exe
6928	powershell.exe
6788	powershell.exe
4224	powershell.exe
5780	powershell.exe
4296	powershell.exe
6788	powershell.exe
3748	powershell.exe
7036	powershell.exe
2924	powershell.exe
4620	powershell.exe
2492	powershell.exe
5968	powershell.exe
6492	powershell.exe
4672	powershell.exe
5592	powershell.exe
5888	powershell.exe
1016	powershell.exe
4300	powershell.exe
6112	powershell.exe
4532	powershell.exe
2296	powershell.exe
884	powershell.exe
5648	powershell.exe
6584	powershell.exe
3304	powershell.exe
5496	powershell.exe
3332	powershell.exe
1852	powershell.exe
2104	powershell.exe
6364	powershell.exe
6636	powershell.exe
4412	powershell.exe
6500	powershell.exe
7000	powershell.exe
1892	powershell.exe
1988	powershell.exe
3568	powershell.exe
4168	powershell.exe
5192	powershell.exe
4440	powershell.exe
1436	powershell.exe
6844	powershell.exe
5960	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
996	wslzsqpm.exe
6044	42sd1ohn.exe
3156	d0mmhpm2.exe
5368	opt5c2o5.exe
4284	h0ihip5z.exe
3008	bx0xonjx.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\lcbhth31 = "C:\\Users\\Admin\\AppData\\Roaming\\lcbhth31.exe"	bx0xonjx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wslzsqpm = "C:\\Users\\Admin\\AppData\\Roaming\\wslzsqpm.exe"	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\42sd1ohn = "C:\\Users\\Admin\\AppData\\Roaming\\42sd1ohn.exe"	wslzsqpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\42sd1ohn = "C:\\Users\\Admin\\AppData\\Roaming\\42sd1ohn.exe"	wslzsqpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0mmhpm2 = "C:\\Users\\Admin\\AppData\\Roaming\\d0mmhpm2.exe"	42sd1ohn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opt5c2o5 = "C:\\Users\\Admin\\AppData\\Roaming\\opt5c2o5.exe"	d0mmhpm2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\bx0xonjx = "C:\\Users\\Admin\\AppData\\Roaming\\bx0xonjx.exe"	h0ihip5z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bx0xonjx = "C:\\Users\\Admin\\AppData\\Roaming\\bx0xonjx.exe"	h0ihip5z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcbhth31 = "C:\\Users\\Admin\\AppData\\Roaming\\lcbhth31.exe"	bx0xonjx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wslzsqpm = "C:\\Users\\Admin\\AppData\\Roaming\\wslzsqpm.exe"	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\d0mmhpm2 = "C:\\Users\\Admin\\AppData\\Roaming\\d0mmhpm2.exe"	42sd1ohn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\opt5c2o5 = "C:\\Users\\Admin\\AppData\\Roaming\\opt5c2o5.exe"	d0mmhpm2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\h0ihip5z = "C:\\Users\\Admin\\AppData\\Roaming\\h0ihip5z.exe"	opt5c2o5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\h0ihip5z = "C:\\Users\\Admin\\AppData\\Roaming\\h0ihip5z.exe"	opt5c2o5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4644	powershell.exe
4644	powershell.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
996	wslzsqpm.exe
996	wslzsqpm.exe
996	wslzsqpm.exe
996	wslzsqpm.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeIncreaseQuotaPrivilege	4644	powershell.exe
Token: SeSecurityPrivilege	4644	powershell.exe
Token: SeTakeOwnershipPrivilege	4644	powershell.exe
Token: SeLoadDriverPrivilege	4644	powershell.exe
Token: SeSystemProfilePrivilege	4644	powershell.exe
Token: SeSystemtimePrivilege	4644	powershell.exe
Token: SeProfSingleProcessPrivilege	4644	powershell.exe
Token: SeIncBasePriorityPrivilege	4644	powershell.exe
Token: SeCreatePagefilePrivilege	4644	powershell.exe
Token: SeBackupPrivilege	4644	powershell.exe
Token: SeRestorePrivilege	4644	powershell.exe
Token: SeShutdownPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeSystemEnvironmentPrivilege	4644	powershell.exe
Token: SeRemoteShutdownPrivilege	4644	powershell.exe
Token: SeUndockPrivilege	4644	powershell.exe
Token: SeManageVolumePrivilege	4644	powershell.exe
Token: 33	4644	powershell.exe
Token: 34	4644	powershell.exe
Token: 35	4644	powershell.exe
Token: 36	4644	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	3748	powershell.exe
Token: SeSecurityPrivilege	3748	powershell.exe
Token: SeTakeOwnershipPrivilege	3748	powershell.exe
Token: SeLoadDriverPrivilege	3748	powershell.exe
Token: SeSystemProfilePrivilege	3748	powershell.exe
Token: SeSystemtimePrivilege	3748	powershell.exe
Token: SeProfSingleProcessPrivilege	3748	powershell.exe
Token: SeIncBasePriorityPrivilege	3748	powershell.exe
Token: SeCreatePagefilePrivilege	3748	powershell.exe
Token: SeBackupPrivilege	3748	powershell.exe
Token: SeRestorePrivilege	3748	powershell.exe
Token: SeShutdownPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeSystemEnvironmentPrivilege	3748	powershell.exe
Token: SeRemoteShutdownPrivilege	3748	powershell.exe
Token: SeUndockPrivilege	3748	powershell.exe
Token: SeManageVolumePrivilege	3748	powershell.exe
Token: 33	3748	powershell.exe
Token: 34	3748	powershell.exe
Token: 35	3748	powershell.exe
Token: 36	3748	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
Token: SeDebugPrivilege	996	wslzsqpm.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4644	3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe	89
PID 996 wrote to memory of 3748	996	wslzsqpm.exe	95
PID 6044 wrote to memory of 4900	6044	42sd1ohn.exe	98
PID 3156 wrote to memory of 4404	3156	d0mmhpm2.exe	102
PID 3368 wrote to memory of 4424	3368	b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe	60
PID 996 wrote to memory of 4424	996	wslzsqpm.exe	60
PID 5368 wrote to memory of 4188	5368	opt5c2o5.exe	107
PID 4284 wrote to memory of 4628	4284	h0ihip5z.exe	110
PID 3008 wrote to memory of 5096	3008	bx0xonjx.exe	170

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe
"C:\Users\Admin\AppData\Local\Temp\b8543ffd8c3064b82b265ef78395f581fa4fee9b3583899e6fd04b23146b070d.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wslzsqpm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4644

C:\Users\Admin\AppData\Roaming\wslzsqpm.exe
C:\Users\Admin\AppData\Roaming\wslzsqpm.exe
1⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\42sd1ohn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748

C:\Users\Admin\AppData\Roaming\42sd1ohn.exe
C:\Users\Admin\AppData\Roaming\42sd1ohn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\d0mmhpm2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4900

C:\Users\Admin\AppData\Roaming\d0mmhpm2.exe
C:\Users\Admin\AppData\Roaming\d0mmhpm2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\opt5c2o5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404

C:\Users\Admin\AppData\Roaming\opt5c2o5.exe
C:\Users\Admin\AppData\Roaming\opt5c2o5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\h0ihip5z.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188

C:\Users\Admin\AppData\Roaming\h0ihip5z.exe
C:\Users\Admin\AppData\Roaming\h0ihip5z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bx0xonjx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

C:\Users\Admin\AppData\Roaming\bx0xonjx.exe
C:\Users\Admin\AppData\Roaming\bx0xonjx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lcbhth31.exe"
  2⤵
  PID:5096

C:\Users\Admin\AppData\Roaming\lcbhth31.exe
C:\Users\Admin\AppData\Roaming\lcbhth31.exe
1⤵
PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rgd1go00.exe"
  2⤵
  PID:3344

C:\Users\Admin\AppData\Roaming\rgd1go00.exe
C:\Users\Admin\AppData\Roaming\rgd1go00.exe
1⤵
PID:2988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\de3bzjjx.exe"
  2⤵
  PID:4692

C:\Users\Admin\AppData\Roaming\de3bzjjx.exe
C:\Users\Admin\AppData\Roaming\de3bzjjx.exe
1⤵
PID:268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fv5bvciy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1016

C:\Users\Admin\AppData\Roaming\fv5bvciy.exe
C:\Users\Admin\AppData\Roaming\fv5bvciy.exe
1⤵
PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jrgtseka.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2624

C:\Users\Admin\AppData\Roaming\jrgtseka.exe
C:\Users\Admin\AppData\Roaming\jrgtseka.exe
1⤵
PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1jwr3khz.exe"
  2⤵
  PID:2564

C:\Users\Admin\AppData\Roaming\1jwr3khz.exe
C:\Users\Admin\AppData\Roaming\1jwr3khz.exe
1⤵
PID:6236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hvbt1nbu.exe"
  2⤵
  PID:6384

C:\Users\Admin\AppData\Roaming\hvbt1nbu.exe
C:\Users\Admin\AppData\Roaming\hvbt1nbu.exe
1⤵
PID:6456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\imrpwn4g.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6568

C:\Users\Admin\AppData\Roaming\imrpwn4g.exe
C:\Users\Admin\AppData\Roaming\imrpwn4g.exe
1⤵
PID:6752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kjt4uwie.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6936

C:\Users\Admin\AppData\Roaming\kjt4uwie.exe
C:\Users\Admin\AppData\Roaming\kjt4uwie.exe
1⤵
PID:7084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gn5haoks.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5944

C:\Users\Admin\AppData\Roaming\gn5haoks.exe
C:\Users\Admin\AppData\Roaming\gn5haoks.exe
1⤵
PID:6760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ifwfty2l.exe"
  2⤵
  PID:2808

C:\Users\Admin\AppData\Roaming\ifwfty2l.exe
C:\Users\Admin\AppData\Roaming\ifwfty2l.exe
1⤵
PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mcgepkwm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7036

C:\Users\Admin\AppData\Roaming\mcgepkwm.exe
C:\Users\Admin\AppData\Roaming\mcgepkwm.exe
1⤵
PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pkgo4sip.exe"
  2⤵
  PID:3216

C:\Users\Admin\AppData\Roaming\pkgo4sip.exe
C:\Users\Admin\AppData\Roaming\pkgo4sip.exe
1⤵
PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wcbkbbmk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2924

C:\Users\Admin\AppData\Roaming\wcbkbbmk.exe
C:\Users\Admin\AppData\Roaming\wcbkbbmk.exe
1⤵
PID:5124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fe0rseer.exe"
  2⤵
  PID:5096

C:\Users\Admin\AppData\Roaming\fe0rseer.exe
C:\Users\Admin\AppData\Roaming\fe0rseer.exe
1⤵
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hugywmpd.exe"
  2⤵
  PID:3780

C:\Users\Admin\AppData\Roaming\hugywmpd.exe
C:\Users\Admin\AppData\Roaming\hugywmpd.exe
1⤵
PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4u1ogbe4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1180

C:\Users\Admin\AppData\Roaming\4u1ogbe4.exe
C:\Users\Admin\AppData\Roaming\4u1ogbe4.exe
1⤵
PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fnm2oq5o.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3484

C:\Users\Admin\AppData\Roaming\fnm2oq5o.exe
C:\Users\Admin\AppData\Roaming\fnm2oq5o.exe
1⤵
PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\b4oj4sx5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6652

C:\Users\Admin\AppData\Roaming\b4oj4sx5.exe
C:\Users\Admin\AppData\Roaming\b4oj4sx5.exe
1⤵
PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vz3yv22w.exe"
  2⤵
  PID:6204

C:\Users\Admin\AppData\Roaming\vz3yv22w.exe
C:\Users\Admin\AppData\Roaming\vz3yv22w.exe
1⤵
PID:6252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dp5azegg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4672

C:\Users\Admin\AppData\Roaming\dp5azegg.exe
C:\Users\Admin\AppData\Roaming\dp5azegg.exe
1⤵
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4udyk5ca.exe"
  2⤵
  PID:6404

C:\Users\Admin\AppData\Roaming\4udyk5ca.exe
C:\Users\Admin\AppData\Roaming\4udyk5ca.exe
1⤵
PID:6756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xgnng5c0.exe"
  2⤵
  PID:1300

C:\Users\Admin\AppData\Roaming\xgnng5c0.exe
C:\Users\Admin\AppData\Roaming\xgnng5c0.exe
1⤵
PID:2396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qjb2rz24.exe"
  2⤵
  PID:6928

C:\Users\Admin\AppData\Roaming\qjb2rz24.exe
C:\Users\Admin\AppData\Roaming\qjb2rz24.exe
1⤵
PID:6348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\55edah0f.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1852

C:\Users\Admin\AppData\Roaming\55edah0f.exe
C:\Users\Admin\AppData\Roaming\55edah0f.exe
1⤵
PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4ebogtdp.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5968

C:\Users\Admin\AppData\Roaming\4ebogtdp.exe
C:\Users\Admin\AppData\Roaming\4ebogtdp.exe
1⤵
PID:5932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\adgsurlh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2104

C:\Users\Admin\AppData\Roaming\adgsurlh.exe
C:\Users\Admin\AppData\Roaming\adgsurlh.exe
1⤵
PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xsz3nn3y.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5648

C:\Users\Admin\AppData\Roaming\xsz3nn3y.exe
C:\Users\Admin\AppData\Roaming\xsz3nn3y.exe
1⤵
PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nrbmqc2c.exe"
  2⤵
  PID:4144

C:\Users\Admin\AppData\Roaming\nrbmqc2c.exe
C:\Users\Admin\AppData\Roaming\nrbmqc2c.exe
1⤵
PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4hzurqxc.exe"
  2⤵
  PID:1988

C:\Users\Admin\AppData\Roaming\4hzurqxc.exe
C:\Users\Admin\AppData\Roaming\4hzurqxc.exe
1⤵
PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sdwej0d1.exe"
  2⤵
  PID:2456

C:\Users\Admin\AppData\Roaming\sdwej0d1.exe
C:\Users\Admin\AppData\Roaming\sdwej0d1.exe
1⤵
PID:6172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\g5xct4bs.exe"
  2⤵
  PID:6424

C:\Users\Admin\AppData\Roaming\g5xct4bs.exe
C:\Users\Admin\AppData\Roaming\g5xct4bs.exe
1⤵
PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\55g4jqcv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3964

C:\Users\Admin\AppData\Roaming\55g4jqcv.exe
C:\Users\Admin\AppData\Roaming\55g4jqcv.exe
1⤵
PID:6384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\q4p430zt.exe"
  2⤵
  PID:4916

C:\Users\Admin\AppData\Roaming\q4p430zt.exe
C:\Users\Admin\AppData\Roaming\q4p430zt.exe
1⤵
PID:6516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\55pn4sih.exe"
  2⤵
  PID:5944

C:\Users\Admin\AppData\Roaming\55pn4sih.exe
C:\Users\Admin\AppData\Roaming\55pn4sih.exe
1⤵
PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vayb22i0.exe"
  2⤵
  PID:6908

C:\Users\Admin\AppData\Roaming\vayb22i0.exe
C:\Users\Admin\AppData\Roaming\vayb22i0.exe
1⤵
PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0favznk4.exe"
  2⤵
  PID:2316

C:\Users\Admin\AppData\Roaming\0favznk4.exe
C:\Users\Admin\AppData\Roaming\0favznk4.exe
1⤵
PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\52ymgzxz.exe"
  2⤵
  PID:1768

C:\Users\Admin\AppData\Roaming\52ymgzxz.exe
C:\Users\Admin\AppData\Roaming\52ymgzxz.exe
1⤵
PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tfvgafan.exe"
  2⤵
  PID:5964

C:\Users\Admin\AppData\Roaming\tfvgafan.exe
C:\Users\Admin\AppData\Roaming\tfvgafan.exe
1⤵
PID:904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ekzy0xav.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6364

C:\Users\Admin\AppData\Roaming\ekzy0xav.exe
C:\Users\Admin\AppData\Roaming\ekzy0xav.exe
1⤵
PID:6352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uynkcntf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4300

C:\Users\Admin\AppData\Roaming\uynkcntf.exe
C:\Users\Admin\AppData\Roaming\uynkcntf.exe
1⤵
PID:5364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cxuqsrdn.exe"
  2⤵
  PID:5464

C:\Users\Admin\AppData\Roaming\cxuqsrdn.exe
C:\Users\Admin\AppData\Roaming\cxuqsrdn.exe
1⤵
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bgiblxyx.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5060

C:\Users\Admin\AppData\Roaming\bgiblxyx.exe
C:\Users\Admin\AppData\Roaming\bgiblxyx.exe
1⤵
PID:6272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0l1kouyj.exe"
  2⤵
  PID:2332

C:\Users\Admin\AppData\Roaming\0l1kouyj.exe
C:\Users\Admin\AppData\Roaming\0l1kouyj.exe
1⤵
PID:1512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\k1kumenq.exe"
  2⤵
  PID:6976

C:\Users\Admin\AppData\Roaming\k1kumenq.exe
C:\Users\Admin\AppData\Roaming\k1kumenq.exe
1⤵
PID:6692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5a5xfks3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7000

C:\Users\Admin\AppData\Roaming\5a5xfks3.exe
C:\Users\Admin\AppData\Roaming\5a5xfks3.exe
1⤵
PID:6320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\u0taeppk.exe"
  2⤵
  PID:7116

C:\Users\Admin\AppData\Roaming\u0taeppk.exe
C:\Users\Admin\AppData\Roaming\u0taeppk.exe
1⤵
PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\znytcrd4.exe"
  2⤵
  PID:2316

C:\Users\Admin\AppData\Roaming\znytcrd4.exe
C:\Users\Admin\AppData\Roaming\znytcrd4.exe
1⤵
PID:6744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rs4tvnny.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6584

C:\Users\Admin\AppData\Roaming\rs4tvnny.exe
C:\Users\Admin\AppData\Roaming\rs4tvnny.exe
1⤵
PID:6780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yl0pvya5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6112

C:\Users\Admin\AppData\Roaming\yl0pvya5.exe
C:\Users\Admin\AppData\Roaming\yl0pvya5.exe
1⤵
PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\whb2hqr5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6636

C:\Users\Admin\AppData\Roaming\whb2hqr5.exe
C:\Users\Admin\AppData\Roaming\whb2hqr5.exe
1⤵
PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xs5eklzj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1892

C:\Users\Admin\AppData\Roaming\xs5eklzj.exe
C:\Users\Admin\AppData\Roaming\xs5eklzj.exe
1⤵
PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ftvcqqid.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1436

C:\Users\Admin\AppData\Roaming\ftvcqqid.exe
C:\Users\Admin\AppData\Roaming\ftvcqqid.exe
1⤵
PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ps4v22h0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6492

C:\Users\Admin\AppData\Roaming\ps4v22h0.exe
C:\Users\Admin\AppData\Roaming\ps4v22h0.exe
1⤵
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wjxs0ajq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6788

C:\Users\Admin\AppData\Roaming\wjxs0ajq.exe
C:\Users\Admin\AppData\Roaming\wjxs0ajq.exe
1⤵
PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ypukpzhn.exe"
  2⤵
  PID:1120

C:\Users\Admin\AppData\Roaming\ypukpzhn.exe
C:\Users\Admin\AppData\Roaming\ypukpzhn.exe
1⤵
PID:6212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\l54og5ne.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4412

C:\Users\Admin\AppData\Roaming\l54og5ne.exe
C:\Users\Admin\AppData\Roaming\l54og5ne.exe
1⤵
PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nxh314yo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2604

C:\Users\Admin\AppData\Roaming\nxh314yo.exe
C:\Users\Admin\AppData\Roaming\nxh314yo.exe
1⤵
PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1kvhukhz.exe"
  2⤵
  PID:4128

C:\Users\Admin\AppData\Roaming\1kvhukhz.exe
C:\Users\Admin\AppData\Roaming\1kvhukhz.exe
1⤵
PID:6528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sh1jphee.exe"
  2⤵
  PID:4292

C:\Users\Admin\AppData\Roaming\sh1jphee.exe
C:\Users\Admin\AppData\Roaming\sh1jphee.exe
1⤵
PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\etdrteen.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4532

C:\Users\Admin\AppData\Roaming\etdrteen.exe
C:\Users\Admin\AppData\Roaming\etdrteen.exe
1⤵
PID:6460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fdsmllkc.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2296

C:\Users\Admin\AppData\Roaming\fdsmllkc.exe
C:\Users\Admin\AppData\Roaming\fdsmllkc.exe
1⤵
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ybl5rnq3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3304

C:\Users\Admin\AppData\Roaming\ybl5rnq3.exe
C:\Users\Admin\AppData\Roaming\ybl5rnq3.exe
1⤵
PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uflmhb0p.exe"
  2⤵
  PID:1708

C:\Users\Admin\AppData\Roaming\uflmhb0p.exe
C:\Users\Admin\AppData\Roaming\uflmhb0p.exe
1⤵
PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\h1zc3bxm.exe"
  2⤵
  PID:5780

C:\Users\Admin\AppData\Roaming\h1zc3bxm.exe
C:\Users\Admin\AppData\Roaming\h1zc3bxm.exe
1⤵
PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\r15sue42.exe"
  2⤵
  PID:6308

C:\Users\Admin\AppData\Roaming\r15sue42.exe
C:\Users\Admin\AppData\Roaming\r15sue42.exe
1⤵
PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\t0fejj2u.exe"
  2⤵
  PID:4492

C:\Users\Admin\AppData\Roaming\t0fejj2u.exe
C:\Users\Admin\AppData\Roaming\t0fejj2u.exe
1⤵
PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\k3hn304w.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6844

C:\Users\Admin\AppData\Roaming\k3hn304w.exe
C:\Users\Admin\AppData\Roaming\k3hn304w.exe
1⤵
PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\unasm4yl.exe"
  2⤵
  PID:2884

C:\Users\Admin\AppData\Roaming\unasm4yl.exe
C:\Users\Admin\AppData\Roaming\unasm4yl.exe
1⤵
PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jnlql2ne.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5592

C:\Users\Admin\AppData\Roaming\jnlql2ne.exe
C:\Users\Admin\AppData\Roaming\jnlql2ne.exe
1⤵
PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wy422ue2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4292

C:\Users\Admin\AppData\Roaming\wy422ue2.exe
C:\Users\Admin\AppData\Roaming\wy422ue2.exe
1⤵
PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fuvpa15b.exe"
  2⤵
  PID:5624

C:\Users\Admin\AppData\Roaming\fuvpa15b.exe
C:\Users\Admin\AppData\Roaming\fuvpa15b.exe
1⤵
PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xhmhcmjf.exe"
  2⤵
  PID:6024

C:\Users\Admin\AppData\Roaming\xhmhcmjf.exe
C:\Users\Admin\AppData\Roaming\xhmhcmjf.exe
1⤵
PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ex21smtp.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1988

C:\Users\Admin\AppData\Roaming\ex21smtp.exe
C:\Users\Admin\AppData\Roaming\ex21smtp.exe
1⤵
PID:6848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cksz5qyv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5496

C:\Users\Admin\AppData\Roaming\cksz5qyv.exe
C:\Users\Admin\AppData\Roaming\cksz5qyv.exe
1⤵
PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qvhb3xov.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5004

C:\Users\Admin\AppData\Roaming\qvhb3xov.exe
C:\Users\Admin\AppData\Roaming\qvhb3xov.exe
1⤵
PID:6672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5ncc3lsd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1396

C:\Users\Admin\AppData\Roaming\5ncc3lsd.exe
C:\Users\Admin\AppData\Roaming\5ncc3lsd.exe
1⤵
PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jidgy4gf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4224

C:\Users\Admin\AppData\Roaming\jidgy4gf.exe
C:\Users\Admin\AppData\Roaming\jidgy4gf.exe
1⤵
PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wznkxuex.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6928

C:\Users\Admin\AppData\Roaming\wznkxuex.exe
C:\Users\Admin\AppData\Roaming\wznkxuex.exe
1⤵
PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5p4utviy.exe"
  2⤵
  PID:4624

C:\Users\Admin\AppData\Roaming\5p4utviy.exe
C:\Users\Admin\AppData\Roaming\5p4utviy.exe
1⤵
PID:6520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4n5vx0cq.exe"
  2⤵
  PID:1320

C:\Users\Admin\AppData\Roaming\4n5vx0cq.exe
C:\Users\Admin\AppData\Roaming\4n5vx0cq.exe
1⤵
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\k3tyard5.exe"
  2⤵
  PID:3208

C:\Users\Admin\AppData\Roaming\k3tyard5.exe
C:\Users\Admin\AppData\Roaming\k3tyard5.exe
1⤵
PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pgl0kbgt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4440

C:\Users\Admin\AppData\Roaming\pgl0kbgt.exe
C:\Users\Admin\AppData\Roaming\pgl0kbgt.exe
1⤵
PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4zr3k2bg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3568

C:\Users\Admin\AppData\Roaming\4zr3k2bg.exe
C:\Users\Admin\AppData\Roaming\4zr3k2bg.exe
1⤵
PID:5880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ez1dyv41.exe"
  2⤵
  PID:8

C:\Users\Admin\AppData\Roaming\ez1dyv41.exe
C:\Users\Admin\AppData\Roaming\ez1dyv41.exe
1⤵
PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\5psje0cg.exe"
  2⤵
  PID:6936

C:\Users\Admin\AppData\Roaming\5psje0cg.exe
C:\Users\Admin\AppData\Roaming\5psje0cg.exe
1⤵
PID:6292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kha1fb3u.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2324

C:\Users\Admin\AppData\Roaming\kha1fb3u.exe
C:\Users\Admin\AppData\Roaming\kha1fb3u.exe
1⤵
PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ljmjtg5w.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5780

C:\Users\Admin\AppData\Roaming\ljmjtg5w.exe
C:\Users\Admin\AppData\Roaming\ljmjtg5w.exe
1⤵
PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\4xwyavgu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5960

C:\Users\Admin\AppData\Roaming\4xwyavgu.exe
C:\Users\Admin\AppData\Roaming\4xwyavgu.exe
1⤵
PID:6736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zr5i52ji.exe"
  2⤵
  PID:5852

C:\Users\Admin\AppData\Roaming\zr5i52ji.exe
C:\Users\Admin\AppData\Roaming\zr5i52ji.exe
1⤵
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\g5ydwha0.exe"
  2⤵
  PID:2304

C:\Users\Admin\AppData\Roaming\g5ydwha0.exe
C:\Users\Admin\AppData\Roaming\g5ydwha0.exe
1⤵
PID:7132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lwnv004b.exe"
  2⤵
  PID:1168

C:\Users\Admin\AppData\Roaming\lwnv004b.exe
C:\Users\Admin\AppData\Roaming\lwnv004b.exe
1⤵
PID:3676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cxih5fnu.exe"
  2⤵
  PID:3704

C:\Users\Admin\AppData\Roaming\cxih5fnu.exe
C:\Users\Admin\AppData\Roaming\cxih5fnu.exe
1⤵
PID:6176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zqfanzq1.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3332

C:\Users\Admin\AppData\Roaming\zqfanzq1.exe
C:\Users\Admin\AppData\Roaming\zqfanzq1.exe
1⤵
PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gd4g0i41.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:884

C:\Users\Admin\AppData\Roaming\gd4g0i41.exe
C:\Users\Admin\AppData\Roaming\gd4g0i41.exe
1⤵
PID:724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cecg4fai.exe"
  2⤵
  PID:4548

C:\Users\Admin\AppData\Roaming\cecg4fai.exe
C:\Users\Admin\AppData\Roaming\cecg4fai.exe
1⤵
PID:6812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\q5fh4ps0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4168

C:\Users\Admin\AppData\Roaming\q5fh4ps0.exe
C:\Users\Admin\AppData\Roaming\q5fh4ps0.exe
1⤵
PID:7164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gfdd5kuv.exe"
  2⤵
  PID:1860

C:\Users\Admin\AppData\Roaming\gfdd5kuv.exe
C:\Users\Admin\AppData\Roaming\gfdd5kuv.exe
1⤵
PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0tooakbe.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6324

C:\Users\Admin\AppData\Roaming\0tooakbe.exe
C:\Users\Admin\AppData\Roaming\0tooakbe.exe
1⤵
PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eiaabqes.exe"
  2⤵
  PID:2692

C:\Users\Admin\AppData\Roaming\eiaabqes.exe
C:\Users\Admin\AppData\Roaming\eiaabqes.exe
1⤵
PID:5852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qliw5g0o.exe"
  2⤵
  PID:6584

C:\Users\Admin\AppData\Roaming\qliw5g0o.exe
C:\Users\Admin\AppData\Roaming\qliw5g0o.exe
1⤵
PID:2800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dsgwvz00.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5592

C:\Users\Admin\AppData\Roaming\dsgwvz00.exe
C:\Users\Admin\AppData\Roaming\dsgwvz00.exe
1⤵
PID:940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\spc1ifwr.exe"
  2⤵
  PID:5132

C:\Users\Admin\AppData\Roaming\spc1ifwr.exe
C:\Users\Admin\AppData\Roaming\spc1ifwr.exe
1⤵
PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xlizntz3.exe"
  2⤵
  PID:6748

C:\Users\Admin\AppData\Roaming\xlizntz3.exe
C:\Users\Admin\AppData\Roaming\xlizntz3.exe
1⤵
PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uwsukyuo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3512

C:\Users\Admin\AppData\Roaming\uwsukyuo.exe
C:\Users\Admin\AppData\Roaming\uwsukyuo.exe
1⤵
PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rwzvm5gg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5888

C:\Users\Admin\AppData\Roaming\rwzvm5gg.exe
C:\Users\Admin\AppData\Roaming\rwzvm5gg.exe
1⤵
PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gwyjnb2t.exe"
  2⤵
  PID:3572

C:\Users\Admin\AppData\Roaming\gwyjnb2t.exe
C:\Users\Admin\AppData\Roaming\gwyjnb2t.exe
1⤵
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qmsacurm.exe"
  2⤵
  PID:1768

C:\Users\Admin\AppData\Roaming\qmsacurm.exe
C:\Users\Admin\AppData\Roaming\qmsacurm.exe
1⤵
PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kioxbjyy.exe"
  2⤵
  PID:6888

C:\Users\Admin\AppData\Roaming\kioxbjyy.exe
C:\Users\Admin\AppData\Roaming\kioxbjyy.exe
1⤵
PID:6536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rcbhamqt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6788

C:\Users\Admin\AppData\Roaming\rcbhamqt.exe
C:\Users\Admin\AppData\Roaming\rcbhamqt.exe
1⤵
PID:6664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nn2yszbp.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6500

C:\Users\Admin\AppData\Roaming\nn2yszbp.exe
C:\Users\Admin\AppData\Roaming\nn2yszbp.exe
1⤵
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\n212wopq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620

C:\Users\Admin\AppData\Roaming\n212wopq.exe
C:\Users\Admin\AppData\Roaming\n212wopq.exe
1⤵
PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\a40mur4u.exe"
  2⤵
  PID:3616

C:\Users\Admin\AppData\Roaming\a40mur4u.exe
C:\Users\Admin\AppData\Roaming\a40mur4u.exe
1⤵
PID:6636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\3ompnejy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5192

C:\Users\Admin\AppData\Roaming\3ompnejy.exe
C:\Users\Admin\AppData\Roaming\3ompnejy.exe
1⤵
PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fvbqcvql.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4296

C:\Users\Admin\AppData\Roaming\fvbqcvql.exe
C:\Users\Admin\AppData\Roaming\fvbqcvql.exe
1⤵
PID:7096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ool2v1vo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2552

C:\Users\Admin\AppData\Roaming\ool2v1vo.exe
C:\Users\Admin\AppData\Roaming\ool2v1vo.exe
1⤵
PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\0rgn5asn.exe"
  2⤵
  PID:5596

C:\Users\Admin\AppData\Roaming\0rgn5asn.exe
C:\Users\Admin\AppData\Roaming\0rgn5asn.exe
1⤵
PID:5992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ib0obmjv.exe"
  2⤵
  PID:6368

C:\Users\Admin\AppData\Roaming\ib0obmjv.exe
C:\Users\Admin\AppData\Roaming\ib0obmjv.exe
1⤵
PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\g3pkugl2.exe"
  2⤵
  PID:2872

C:\Users\Admin\AppData\Roaming\g3pkugl2.exe
C:\Users\Admin\AppData\Roaming\g3pkugl2.exe
1⤵
PID:6296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ddgp2qzd.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5644

C:\Users\Admin\AppData\Roaming\ddgp2qzd.exe
C:\Users\Admin\AppData\Roaming\ddgp2qzd.exe
1⤵
PID:6204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpx01xlh.exe"
  2⤵
  PID:4724

C:\Users\Admin\AppData\Roaming\gpx01xlh.exe
C:\Users\Admin\AppData\Roaming\gpx01xlh.exe
1⤵
PID:6524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wfhedf13.exe"
  2⤵
  PID:4404

C:\Users\Admin\AppData\Roaming\wfhedf13.exe
C:\Users\Admin\AppData\Roaming\wfhedf13.exe
1⤵
PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\w4pveoeq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2492

C:\Users\Admin\AppData\Roaming\w4pveoeq.exe
C:\Users\Admin\AppData\Roaming\w4pveoeq.exe
1⤵
PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ocpckncw.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...