a5c0dca0d097efa62ba39b144a6a85352296babded76040ebaab76e255a9a451

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AspasSetting By Def&Zen/Aspas Setting.exe
Size 4.1MB
Sample260727-pyachsszas
SHA256 a5c0dca0d097efa62ba39b144a6a85352296babded76040ebaab76e255a9a451
MD5 a33f1ebbadff20e336cbd8b80909c7eb
SHA1 322ba73e5a2c01052d755ebb93f0cc9ac5830b2b
SHA512 3ceb567efca0237e5d094a3f552019928f3876013025c00f911ad758bbd68fc9730bdab082fc5f7096efcab45802f9a7fc7c843f77dd14d6b929705266299394
SSDEEP 49152:lqmfEfcnrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtc55:lEforzwUI5o9NniEoqDL412gF2eQP1I
TLSH
T12616E1A2D9C0E15CC663C1704D1B71019629B6FF27F8B1CABADE442DAF61B41CD27B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5068	msedgewebview2.exe
4760	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Aspas Setting.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3684	Aspas Setting.exe
3684	Aspas Setting.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_746548991\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1891209820\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_746548991\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_746548991\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_746548991\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_746548991\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1891209820\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1509870290\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1891209820\manifest.fingerprint	msedgewebview2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
936	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
5628	powershell.exe
5628	powershell.exe
5628	powershell.exe
5068	msedgewebview2.exe
5068	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5068	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeIncreaseQuotaPrivilege	5176	powershell.exe
Token: SeSecurityPrivilege	5176	powershell.exe
Token: SeTakeOwnershipPrivilege	5176	powershell.exe
Token: SeLoadDriverPrivilege	5176	powershell.exe
Token: SeSystemProfilePrivilege	5176	powershell.exe
Token: SeSystemtimePrivilege	5176	powershell.exe
Token: SeProfSingleProcessPrivilege	5176	powershell.exe
Token: SeIncBasePriorityPrivilege	5176	powershell.exe
Token: SeCreatePagefilePrivilege	5176	powershell.exe
Token: SeBackupPrivilege	5176	powershell.exe
Token: SeRestorePrivilege	5176	powershell.exe
Token: SeShutdownPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeSystemEnvironmentPrivilege	5176	powershell.exe
Token: SeRemoteShutdownPrivilege	5176	powershell.exe
Token: SeUndockPrivilege	5176	powershell.exe
Token: SeManageVolumePrivilege	5176	powershell.exe
Token: 33	5176	powershell.exe
Token: 34	5176	powershell.exe
Token: 35	5176	powershell.exe
Token: 36	5176	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	4660	powershell.exe
Token: SeSecurityPrivilege	4660	powershell.exe
Token: SeTakeOwnershipPrivilege	4660	powershell.exe
Token: SeLoadDriverPrivilege	4660	powershell.exe
Token: SeSystemProfilePrivilege	4660	powershell.exe
Token: SeSystemtimePrivilege	4660	powershell.exe
Token: SeProfSingleProcessPrivilege	4660	powershell.exe
Token: SeIncBasePriorityPrivilege	4660	powershell.exe
Token: SeCreatePagefilePrivilege	4660	powershell.exe
Token: SeBackupPrivilege	4660	powershell.exe
Token: SeRestorePrivilege	4660	powershell.exe
Token: SeShutdownPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeSystemEnvironmentPrivilege	4660	powershell.exe
Token: SeRemoteShutdownPrivilege	4660	powershell.exe
Token: SeUndockPrivilege	4660	powershell.exe
Token: SeManageVolumePrivilege	4660	powershell.exe
Token: 33	4660	powershell.exe
Token: 34	4660	powershell.exe
Token: 35	4660	powershell.exe
Token: 36	4660	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeIncreaseQuotaPrivilege	5628	powershell.exe
Token: SeSecurityPrivilege	5628	powershell.exe
Token: SeTakeOwnershipPrivilege	5628	powershell.exe
Token: SeLoadDriverPrivilege	5628	powershell.exe
Token: SeSystemProfilePrivilege	5628	powershell.exe
Token: SeSystemtimePrivilege	5628	powershell.exe
Token: SeProfSingleProcessPrivilege	5628	powershell.exe
Token: SeIncBasePriorityPrivilege	5628	powershell.exe
Token: SeCreatePagefilePrivilege	5628	powershell.exe
Token: SeBackupPrivilege	5628	powershell.exe
Token: SeRestorePrivilege	5628	powershell.exe
Token: SeShutdownPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeSystemEnvironmentPrivilege	5628	powershell.exe
Token: SeRemoteShutdownPrivilege	5628	powershell.exe
Token: SeUndockPrivilege	5628	powershell.exe
Token: SeManageVolumePrivilege	5628	powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 5068	3684	Aspas Setting.exe	89
PID 5068 wrote to memory of 3348	5068	msedgewebview2.exe	90
PID 5068 wrote to memory of 4132	5068	msedgewebview2.exe	91
PID 5068 wrote to memory of 4132	5068	msedgewebview2.exe	91
PID 5068 wrote to memory of 4132	5068	msedgewebview2.exe	91
PID 5068 wrote to memory of 4132	5068	msedgewebview2.exe	91
PID 5068 wrote to memory of 5016	5068	msedgewebview2.exe	92
PID 5068 wrote to memory of 4676	5068	msedgewebview2.exe	93
PID 5068 wrote to memory of 4676	5068	msedgewebview2.exe	93
PID 5068 wrote to memory of 4676	5068	msedgewebview2.exe	93
PID 5068 wrote to memory of 4760	5068	msedgewebview2.exe	94
PID 5068 wrote to memory of 4760	5068	msedgewebview2.exe	94
PID 5068 wrote to memory of 4760	5068	msedgewebview2.exe	94
PID 5068 wrote to memory of 4760	5068	msedgewebview2.exe	94
PID 5068 wrote to memory of 4760	5068	msedgewebview2.exe	94
PID 3684 wrote to memory of 936	3684	Aspas Setting.exe	95
PID 936 wrote to memory of 2996	936	powershell.exe	97
PID 936 wrote to memory of 3616	936	powershell.exe	98
PID 3684 wrote to memory of 1256	3684	Aspas Setting.exe	99
PID 3684 wrote to memory of 5176	3684	Aspas Setting.exe	101
PID 3684 wrote to memory of 4660	3684	Aspas Setting.exe	104
PID 3684 wrote to memory of 5628	3684	Aspas Setting.exe	108
PID 5068 wrote to memory of 3064	5068	msedgewebview2.exe	113
PID 5068 wrote to memory of 3064	5068	msedgewebview2.exe	113
PID 5068 wrote to memory of 3064	5068	msedgewebview2.exe	113
PID 5068 wrote to memory of 3520	5068	msedgewebview2.exe	114
PID 5068 wrote to memory of 3520	5068	msedgewebview2.exe	114
PID 5068 wrote to memory of 3520	5068	msedgewebview2.exe	114
PID 5068 wrote to memory of 2000	5068	msedgewebview2.exe	115
PID 5068 wrote to memory of 2000	5068	msedgewebview2.exe	115
PID 5068 wrote to memory of 2000	5068	msedgewebview2.exe	115
PID 5068 wrote to memory of 5564	5068	msedgewebview2.exe	116
PID 5068 wrote to memory of 5564	5068	msedgewebview2.exe	116
PID 5068 wrote to memory of 5564	5068	msedgewebview2.exe	116

C:\Users\Admin\AppData\Local\Temp\AspasSetting By Def&Zen\Aspas Setting.exe
"C:\Users\Admin\AppData\Local\Temp\AspasSetting By Def&Zen\Aspas Setting.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Aspas Setting.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-gpu --disable-gpu-compositing --enable-features=MojoIpcz --remote-debugging-port=9222 --mojo-named-platform-channel-pipe=3684.4172.16394413659546628833 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView /prefetch:4 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffb28d35fd8,0x7ffb28d35fe4,0x7ffb28d35ff0
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1984 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name="Aspas Setting.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1744,i,9051425976617079488,12907721032344912855,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5564
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJAB0AGMAcABHAGwAbwBiAGEAbAAgAD0AIABuAGUAdABzAGgAIABpAG4AdAAgAHQAYwBwACAAcwBoAG8AdwAgAGcAbABvAGIAYQBsADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGUAIABpAG4AIAAkAHQAYwBwAEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlAC0AUwBpAGQAZQAgAFMAYwBhAGwAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBzACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlACAAUwBlAGcAbQBlAG4AdAAgAEMAbwBhAGwAZQBzAGMAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBjACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBDAGgAaQBtAG4AZQB5ACAATwBmAGYAbABvAGEAZAAgAFMAdABhAHQAZQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAYwBoAGkAbQBuAGUAeQAnAF0AIAA9ACAAJABNAGEAdABjAGgAZQBzAFsAMQBdACAAfQAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBuAGUAIAAtAG0AYQB0AGMAaAAgACcATgBlAHQARABNAEEAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AZQB0AGQAbQBhACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBOAG8AbgAgAFMAYQBjAGsAIABSAHQAdAAgAFIAZQBzAGkAbABpAGUAbgBjAHkAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AbwBuAHMAYQBjAGsAJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAAgACAAIAAgAGkAZgAgACgAJABsAGkAbgBlACAALQBtAGEAdABjAGgAIAAnAEUAQwBOACAAQwBhAHAAYQBiAGkAbABpAHQAeQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAZQBjAG4AJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAB9ACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACAAPQAgAG4AZQB0AHMAaAAgAGkAbgB0ACAAaQBwAHYANAAgAHMAaABvAHcAIABnAGwAbwBiAGEAbAA7ACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBlACAAaQBuACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBEAGUAZgBhAHUAbAB0ACAASABvAHAAIABMAGkAbQBpAHQAXABzACoAOgBcAHMAKgAoAFwAZAArACkAJwApACAAewAgACQAcgBlAHMAWwAnAGgAbwBwACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAfQAgACQAdABjAHAAaQBwAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFQAYwBwAGkAcABcAFAAYQByAGEAbQBlAHQAZQByAHMAJwA7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHQAYwBwAGkAcABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAHIAZQBzAFsAJwBEAGkAcwBhAGIAbABlAFQAYQBzAGsATwBmAGYAbABvAGEAZAAnAF0AIAA9ACAAaQBmACAAKAAkAHQAYwBwAGkAcABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4AUABTAE8AYgBqAGUAYwB0AC4AUAByAG8AcABlAHIAdABpAGUAcwBbACcARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAJwBdACkAIAB7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4ARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAHIAZQBzAFsAJwBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJAB0AGMAcABpAHAAUAByAG8AcABzACAALQBhAG4AZAAgACQAdABjAHAAaQBwAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEUAbgBhAGIAbABlAFcAYQBuAG4AYQBPAHUAdABjAG8AbQBpAG4AZwAnAF0AKQAgAHsAIAAkAHQAYwBwAGkAcABQAHIAbwBwAHMALgBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAGEAZgBkAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAEEARgBEAFwAUABhAHIAYQBtAGUAdABlAHIAcwAnADsAIAAkAGEAZgBkAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABhAGYAZABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAGEAZgBkAEsAZQB5AHMAIAA9ACAAQAAoACcARABlAGYAYQB1AGwAdABSAGUAYwBlAGkAdgBlAFcAaQBuAGQAbwB3ACcALAAgACcARABlAGYAYQB1AGwAdABTAGUAbgBkAFcAaQBuAGQAbwB3ACcALAAgACcAQgB1AGYAZgBlAHIATQB1AGwAdABpAHAAbABpAGUAcgAnACwAIAAnAEIAdQBmAGYAZQByAEEAbABpAGcAbgBtAGUAbgB0ACcALAAgACcARABvAE4AbwB0AEgAbwBsAGQATgBJAEMAQgB1AGYAZgBlAHIAcwAnACwAIAAnAFQAcgBhAG4AcwBtAGkAdABXAG8AcgBrAGUAcgAnACwAIAAnAFAAcgBpAG8AcgBpAHQAeQBCAG8AbwBzAHQAJwAsACAAJwBTAG0AYQBsAGwAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAFMAaQB6AGUAJwAsACAAJwBMAGEAcgBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAEgAdQBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAFMAbQBhAGwAbABCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAEwAaQBzAHQARABlAHAAdABoACcALAAgACcATABhAHIAZwBCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAQQBkAGQAcgBlAHMAcwBTAGgAYQByAGkAbgBnACcALAAgACcARABpAHMAYQBiAGwAZQBDAGgAYQBpAG4AZQBkAFIAZQBjAGUAaQB2AGUAJwAsACAAJwBEAGkAcwBhAGIAbABlAEQAaQByAGUAYwB0AEEAYwBjAGUAcAB0AEUAeAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAUgBhAHcAUwBlAGMAdQByAGkAdAB5ACcALAAgACcARAB5AG4AYQBtAGkAYwBTAGUAbgBkAEIAdQBmAGYAZQByAEQAaQBzAGEAYgBsAGUAJwAsACAAJwBGAGEAcwB0AFMAZQBuAGQARABhAHQAYQBnAHIAYQBtAFQAaAByAGUAcwBoAG8AbABkACcALAAgACcARgBhAHMAdABDAG8AcAB5AFIAZQBjAGUAaQB2AGUAVABoAHIAZQBzAGgAbwBsAGQAJwAsACAAJwBJAGcAbgBvAHIAZQBQAHUAcwBoAEIAaQB0AE8AbgBSAGUAYwBlAGkAdgBlAHMAJwAsACAAJwBJAGcAbgBvAHIAZQBPAHIAZABlAHIAbAB5AFIAZQBsAGUAYQBzAGUAJwApADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGEAZgBkAEsAZQB5AHMAKQAgAHsAIAAgACAAIAAgAGkAZgAgACgAJABhAGYAZABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJABhAGYAZABQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJABrAF0AKQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAJABhAGYAZABQAHIAbwBwAHMALgAkAGsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAIgAiACAAfQAgAH0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHIAZQBzACAALQBDAG8AbQBwAHIAZQBzAHMA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2996
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int ipv4 show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3616
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJABmAG0AUABhAHQAaAAgAD0AIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAEMAaQB0AGkAegBlAG4ARgBYAFwARgBpAHYAZQBNACcAOwAgACQAZgBtAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABmAG0AUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcAQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACcAXQAgAD0AIABpAGYAIAAoACQAZgBtAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGYAbQBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAEUARgBIAGEAcgBkAHcAYQByAGUAQQBjAGMAZQBsAGUAcgBhAHQAaQBvAG4AJwBdACkAIAB7ACAAJABmAG0AUAByAG8AcABzAC4AQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAJABmAG0AUAByAGkAUABhAHQAaAAgAD0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbQBhAGcAZQAgAEYAaQBsAGUAIABFAHgAZQBjAHUAdABpAG8AbgAgAE8AcAB0AGkAbwBuAHMAXABGAGkAdgBlAE0ALgBlAHgAZQBcAFAAZQByAGYATwBwAHQAaQBvAG4AcwAnADsAIAAkAGYAbQBQAHIAaQBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAZgBtAFAAcgBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACQAcgBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACAAPQAgAGkAZgAgACgAJABmAG0AUAByAGkAUAByAG8AcABzACAALQBhAG4AZAAgACQAZgBtAFAAcgBpAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACkAIAB7ACAAJABmAG0AUAByAGkAUAByAG8AcABzAC4AQwBwAHUAUAByAGkAbwByAGkAdAB5AEMAbABhAHMAcwAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0AOwAgACQAdABpAG0AZQByAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABTAGUAcwBzAGkAbwBuACAATQBhAG4AYQBnAGUAcgBcAGsAZQByAG4AZQBsACcAOwAgACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJAB0AGkAbQBlAHIAUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACcAXQAgAD0AIABpAGYAIAAoACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAHQAaQBtAGUAcgBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBHAGwAbwBiAGEAbABUAGkAbQBlAHIAUgBlAHMAbwBsAHUAdABpAG8AbgBSAGUAcQB1AGUAcwB0AHMAJwBdACkAIAB7ACAAJAB0AGkAbQBlAHIAUAByAG8AcABzAC4ARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand dAByAHkAIAB7ACAAIAAgACAAIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAEgAQQBSAEQAVwBBAFIARQBcAEQARQBTAEMAUgBJAFAAVABJAE8ATgBcAFMAeQBzAHQAZQBtAFwAQgBJAE8AUwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBCAGEAcwBlAEIAbwBhAHIAZABQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBHAGUAbgBlAHIAaQBjACAATQBvAHQAaABlAHIAYgBvAGEAcgBkACIAIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5176
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABsAGkAcwB0ACAAPQAgAEAAKAApADsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJABmAGEAbABzAGUAOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBQAGgAeQBzAGkAYwBhAGwAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA7AEcAdQBpAGQAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAfQAgACAAIAAgACAAIAAgACAAIAB9ACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABsAGkAcwB0AC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAJABzAHUAYwBjAGUAcwBzACAAPQAgACQAdAByAHUAZQAgAH0AIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ADsAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHMAdQBjAGMAZQBzAHMAKQAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGEAZAAgAGkAbgAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAFAAaAB5AHMAaQBjAGEAbABBAGQAYQBwAHQAZQByAD0AVAByAHUAZQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGEAZAAuAE4AZQB0AEMAbwBuAG4AZQBjAHQAaQBvAG4ASQBEADsARABlAHMAYwA9ACQAYQBkAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuADsARwB1AGkAZAA9ACQAYQBkAC4ARwBVAEkARAB9ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBzAHQALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJAB0AHIAdQBlACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AQwBsAGEAcwBzACAAVwBpAG4AMwAyAF8ATgBlAHQAdwBvAHIAawBBAGQAYQBwAHQAZQByACAALQBGAGkAbAB0AGUAcgAgACIAUABoAHkAcwBpAGMAYQBsAEEAZABhAHAAdABlAHIAPQBUAHIAdQBlACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBlAHQAQwBvAG4AbgBlAGMAdABpAG8AbgBJAEQAOwBEAGUAcwBjAD0AJABhAGQALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AOwBHAHUAaQBkAD0AJABhAGQALgBHAFUASQBEAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbABpAHMAdAAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAApACAAewAgACQAcwB1AGMAYwBlAHMAcwAgAD0AIAAkAHQAcgB1AGUAIAB9ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQA7ACAAaQBmACAAKAAtAG4AbwB0ACAAJABzAHUAYwBjAGUAcwBzACkAIAB7ACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbgBuAHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABOAGUAdAB3AG8AcgBrAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAQgBFADEAMAAzADEAOAB9ACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGMAIABpAG4AIAAkAGMAbwBuAG4AcwApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG4AbgBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIAJAAoACQAYwAuAFAAUwBQAGEAdABoACkAXABDAG8AbgBuAGUAYwB0AGkAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAG8AbgBuAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEcAdQBpAGQAPQAkAGMALgBQAFMAQwBoAGkAbABkAE4AYQBtAGUAfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgACQAbABpAHMAdAAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABnAHUAaQBkACAAPQAgACIAewA0ADYARABBADQAQgBCADQALQAwADMARAAzAC0ANAA1AEQAQQAtADkAMQBFAEQALQA3AEUANgA0ADAAQQBCAEEAMwAwADYAQQB9ACIAOwAgACQAZABlAHMAYwAgAD0AIAAiAFIAZQBhAGwAdABlAGsAIABSAFQATAA4ADEAMwA5AEMAKwAgAEYAYQBzAHQAIABFAHQAaABlAHIAbgBlAHQAIABOAEkAQwAiADsAIAAkAHMAdQBiACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEMAbABhAHMAcwBcAHsANABEADMANgBFADkANwAyAC0ARQAzADIANQAtADEAMQBDAEUALQBCAEYAQwAxAC0AMAA4ADAAMAAyAGIARQAxADAAMwAxADgAfQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAFAAUwBDAGgAaQBsAGQATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeAFwAZAB7ADQAfQAkACcAIAB9ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAXwAuAFAAUwBQAGEAdABoACAALQBOAGEAbQBlACAAIgBOAGUAdABDAGYAZwBJAG4AcwB0AGEAbgBjAGUASQBkACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAE4AZQB0AEMAZgBnAEkAbgBzAHQAYQBuAGMAZQBJAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAAUABTAEMAaABpAGwAZABOAGEAbQBlADsAIAAkAHIAZQBzACAAPQAgAEAAewB9ADsAIABpAGYAIAAoACQAcwB1AGIAKQAgAHsAIAAgACAAIAAgACQAYQBwACAAPQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAYgBFADEAMAAzADEAOAB9AFwAJABzAHUAYgAiADsAIAAgACAAIAAgACQAcAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAIAAgACAAIAAkAGsAZQB5AHMAIAA9ACAAQAAoACcAKgBGAGwAbwB3AEMAbwBuAHQAcgBvAGwAJwAsACAAJwAqAEkAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBMAHMAbwBWADIASQBQAHYANAAnACwAIAAnACoATABzAG8AVgAyAEkAUAB2ADYAJwAsACAAJwAqAFAAcgBpAG8AcgBpAHQAeQBWAEwAQQBOAFQAYQBnACcALAAgACcAKgBJAG4AdABlAHIAcgB1AHAAdABNAG8AZABlAHIAYQB0AGkAbwBuACcALAAgACcASQBUAFIAJwAsACAAJwAqAFAAYQBjAGsAZQB0AEQAaQByAGUAYwB0ACcALAAgACcAKgBSAGUAYwBlAGkAdgBlAEIAdQBmAGYAZQByAHMAJwAsACAAJwAqAFQAcgBhAG4AcwBtAGkAdABCAHUAZgBmAGUAcgBzACcALAAgACcAVAB4AEkAbgB0AEQAZQBsAGEAeQAnACwAIAAnAEMAbwBhAGwAZQBzAGMAZQBCAHUAZgBmAGUAcgBTAGkAegBlACcALAAgACcAKgBQAE0AQQBSAFAATwBmAGYAbABvAGEAZAAnACwAIAAnACoAUABNAE4AUwBPAGYAZgBsAG8AYQBkACcAKQA7ACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGsAZQB5AHMAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAGsAXQApACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAkAHAAcgBvAHAAcwAuACQAawAgAH0AIABlAGwAcwBlACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAiACIAIAB9ACAAIAAgACAAIAB9ACAAIAAgACAAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ASQBuAHQAZQByAGYAYQBjAGUARABlAHMAYwByAGkAcAB0AGkAbwBuACAAJABkAGUAcwBjACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBQAG4AcABJAEQAOwAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwAG4AcABJAGQAKQAgAHsAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0AUABoAHkAcwBpAGMAYQBsACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AKQAuAFAAbgBwAEkARAA7ACAAfQAgACAAIAAgACAAaQBmACAAKAAkAHAAbgBwAEkAZAApACAAewAgACAAIAAgACAAIAAgACAAIAAkAG0AcwBpAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEUAbgB1AG0AXAAkAHAAbgBwAEkAZABcAEQAZQB2AGkAYwBlACAAUABhAHIAYQBtAGUAdABlAHIAcwBcAEkAbgB0AGUAcgByAHUAcAB0ACAATQBhAG4AYQBnAGUAbQBlAG4AdABcAE0AZQBzAHMAYQBnAGUAUwBpAGcAbgBhAGwAZQBkAEkAbgB0AGUAcgByAHUAcAB0AFAAcgBvAHAAZQByAHQAaQBlAHMAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAbQBzAGkAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAG0AcwBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbQBzAGkAUAByAG8AcABzACkAIAB7ACAAJAByAGUAcwBbACcATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAJwBdACAAPQAgACQAbQBzAGkAUAByAG8AcABzAC4ATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJwBNAFMASQBTAHUAcABwAG8AcgB0AGUAZAAnAF0AIAA9ACAAIgAiACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUABhAHQAaAAgAD0AIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwARQBuAHUAbQBcACQAcABuAHAASQBkAFwARABlAHYAaQBjAGUAIABQAGEAcgBhAG0AZQB0AGUAcgBzAFwASQBuAHQAZQByAHIAdQBwAHQAIABNAGEAbgBhAGcAZQBtAGUAbgB0AFwAQQBmAGYAaQBuAGkAdAB5ACAAUABvAGwAaQBjAHkAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAZgBmAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYQBmAGYAUAByAG8AcABzACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUAByAGkAbwByAGkAdAB5ACcAXQAgAD0AIAAkAGEAZgBmAFAAcgBvAHAAcwAuAEQAZQB2AGkAYwBlAFAAcgBpAG8AcgBpAHQAeQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACQAYQBmAGYAUAByAG8AcABzAC4ARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAOwAgACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBEAGUAdgBpAGMAZQBQAHIAaQBvAHIAaQB0AHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgAH0AIAAgACAAIAAgACQAbgBlAHQASQBwACAAPQAgAEcAZQB0AC0ATgBlAHQASQBQAEkAbgB0AGUAcgBmAGEAYwBlACAALQBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAkAGQAZQBzAGMAIAAtAEEAZABkAHIAZQBzAHMARgBhAG0AaQBsAHkAIABJAFAAdgA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAgACAAIAAgAGkAZgAgACgAJABuAGUAdABJAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQB0AHUAJwBdACAAPQAgACQAbgBlAHQASQBwAC4ATgBsAE0AdAB1ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAYQBkAHYAUgBvAHUAdABlACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGUARABlAGYAYQB1AGwAdABSAG8AdQB0AGUAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBhAGQAdgBlAHIAdABpAHMAaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAGQAdgBlAHIAdABpAHMAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGkAbgBnACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQBlAHQAcgBpAGMAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAHUAdABvAG0AYQB0AGkAYwBNAGUAdAByAGkAYwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAG0AcwBzACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQwBsAGEAbQBwAE0AcwBzACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAZgBvAHIAdwBhAHIAZABpAG4AZwAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEYAbwByAHcAYQByAGQAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4ARgBvAHIAdwBhAHIAZABpAG4AZwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAGkAZwBuAG8AcgBlAFIAbwB1AHQAZQAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEkAZwBuAG8AcgBlAEQAZQBmAGEAdQBsAHQAUgBvAHUAdABlAHMAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAG8AdQB0AGUAcgBEAGkAcwBjACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBiAGEAcwBlAFIAZQBhAGMAaAAnAF0AIAA9ACAAJABuAGUAdABJAHAALgBCAGEAcwBlAFIAZQBhAGMAaABhAGIAbABlAFQAaQBtAGUAOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAGUAdAByAGEAbgBzACcAXQAgAD0AIAAkAG4AZQB0AEkAcAAuAFIAZQB0AHIAYQBuAHMAbQBpAHQAVABpAG0AZQA7ACAAIAAgACAAIAB9ACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2ad21a8478c318810663631ac97d10409272c849cd9d3a56fae76815c3f77386
MD5 7f8885acc1ada31457e8828edd40fd1d
SHA1 e88e548c5010a7a84ee8528c819ce632c875072b
SHA512 c09f726b47eeeea2cb3e2f9aa91ca873c8be2e0bb41674f7f564a5c41ed65d9ab19058f32701a5bf267f0b37a36cf036d1d6719b029897394d6cd85b0d86af70
TLSH
T1F731CE37B7CC4695C85E443600CD9C1032F586DB80DEDF9BB741D445792F5C4DE64950
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 242ef9623f1bb360038b7d9c5ac17b713bf2f09409bc1079b4edec3bb314128b
MD5 d27cf59fc468030c2d12e72e735024de
SHA1 f648312e1fa5aec3003195d151f3971e45abf712
SHA512 edc1da66951fa1bf1e550dcc7ed99b2297d2e41400d5614ee641a38269043e33dae7a346a5a2dc6bcd62ae8182c52ef8454b12f5e6de3f191024571f6b6a6b9c
TLSH
T15831CB3BB7CC86A5C89D403A00CDAC1431F586DB85DEDE9BBB81D445786F6C4DEA8950
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e913af3b3ddf6f603230badef18deb6c3bad9792fc7bae8170d868f92ffc13fa
MD5 2218a4b5b1c3eff38c14873b7d74407e
SHA1 7400e5654e396b6655eb9262df6dadbd0dcdebb0
SHA512 ac089560b8283d5bf27e742c743521e8eed8e0de1c937faf5904a3b1014f074515e3c69a94026896de600472490a3a0e465645b74c431f5832009c8950ddde6c
TLSH
T1AE219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B81E159A42F298CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 da83bd61c1063a51852c0571c7762d6deedcb55e9c814e458bc9dedf7cc1f6a9
MD5 6425d275478e049f14d732ee601cd743
SHA1 72e3fa66000a46e28b1ca3e1d70d14a301fb8a33
SHA512 536718ac88e7818e9e8c4f1c25bcb2b3c58e1f6068d70216fc9e3b364f40bccd4fdda372a8bb42c37008d78df8f2017fe17079f417bf084e3851080db8a3c3ca
TLSH
T17731BD6BB3DC8656C89A403610CDA85032B987DB819F8E977A80D245B43F389DE64394
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 15d873f0d64eff53bc969d2dd6dd0781718478f19a8cde101e50c36c096f934f
MD5 76c36fcfe6abad3f960ac85c251d7080
SHA1 bc183a30eab7993f2c0396784df5fc16c9614044
SHA512 cfd36ab26f503d1a20d426092959718df507306a19562652ad1becd733768bb04ce14eec4a48f52a3d0c982fef975aa7f6306cf6a6150c5285695e90de91fa59
TLSH
T1E6D0121332110176C01120331722720C1940C10B80454201982C8E7D5F044953942841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 edbf7cd31619db53c500759fd06272524e0e04acf1123849aa82962bc69b28e9
MD5 0ad4f81c0dd37fe5a301248f68acb35b
SHA1 b6f724c224870e8af4f36d94e4bf0ac54315c6d6
SHA512 4af4103269816cf26260cd1eb013c692f329e63b7a9bec182d81204715b3b3c71d851630324a7ef1c7f5b31cbe29d7bbcc15a0692393d939944afdfd5599c253
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 fedaef13892f46fb34fb2e9f47712a214397c9165682874fe3f31bf1d4940cf3
MD5 5c1c67d5b56a6c31a319cdfc3f8a2013
SHA1 f1bd8ee2d555ced76d364b6665366543a51eeb1a
SHA512 db3374384c00df8aa093bcffce252ecf1d8c512bbedf60d1a6a939f63dacec9e91504139f2d2fa7a73ccaa5460bad982557d47af7be5bcf65cedc3e3f697050e
TLSH
T1DB5146BAC3D8477E889152F45A366926CD1D555B82283C578CE5AFCF63E14B0E20128F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2183.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State~RFe5a2183.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 3520cb85d98790aee70be63eaddcea3c194f4901e303a04346ed7989f3a0b4cc
MD5 8404b5d76605d905db4073e069ce22b9
SHA1 9010cf65aad4fc3bcfa7f62f10378a152d0fd71c
SHA512 dcb41664c6c57af5eb4669acf0b2ba52448ff2c7f160aaeb287c34063577ac1968800540c1c3be2594a7358d8fa2d7e0d5a9565a705cfe3bde480c390cf22285
SSDEEP 96:st0/dDS2UG36b9Sk7go5h16Zdrs7/x+6MhmuecmAd2zCdeXK+gXi+28XM1C7K:st4hpVosrsV+FiAd2zCd5p3G6K
TLSH
T187D196079F24697B4CCAE629FA25BB12D2E56432A5A45E98EBFC461C04DB5DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e91e9932-efd9-43b2-bfce-4b3cb28f209e.tmp

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\e91e9932-efd9-43b2-bfce-4b3cb28f209e.tmp
Size 6KB
SHA256 3b6f17252ca1c59a54969e380fc9f16b01ee7280111d19da56c2b89b82c3155c
MD5 7f2f6733f02198f5e0f8f900aedcb1ec
SHA1 38f4302eaff41f2b1465a8185bd757a4a5d567a9
SHA512 8a631f7b0da84b5f018b5c2e415691297180abd3f9eca20173acfbfbcb637451122e9c53757832fbf88a4365163c49f89f8377776d2dd724ddbe3e4853de9589
SSDEEP 96:st0/dDS2d36b9Sk7go5h16Zdrs7/x+6MhmuecmAd2zCdeXK+gB28XM1C7K:st4hnVosrsV+FiAd2zCd5zG6K
TLSH
T136D1B7079F24697B4CCAE629FA25BB12E2F56432A5D05E94EBF8861C04DB5DC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 2KB
SHA256 d12ec674261a65aa25456fa8def4d8be57e31f8c8fe9f0128deee05a0e91bbc5
MD5 216cf5fd5a6d1be4edc67badf8f151c9
SHA1 164e4c4c4508825a2d444d1569c82ab5848a9511
SHA512 86c014d0eda3afde6a89452a42756c2190bcfa9a72f181a80e4ce908cf8c4ad3cedc98bd7f726c75f0836aedaab5f3de6aca0b1c78bf5ce30c7e549936ae799c
TLSH
T13A516433A8209B778AE2471DB54B7E239EB560A2DA521F909EDD0B0C01DB68C1302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 e23c263e19ed1aba4f6e6c314ba656604ae6fc363e08f3c377f6c3628aea9477
MD5 1db980f64097eb63cb413b7a8e6dea5a
SHA1 ec2d8ea5d2a06dc626d1277e8a7d1ffb8f1e4b8d
SHA512 5b68fc2ffafa5be09a51fb3317acdcdf419d02fa723ea7b869ad03788c2a9e4c2cf48af7c38d061025a2b3bdbf629ed23885ee536d09f2c59fabddc5db1a239f
TLSH
T18D61563BA9709A278EF29B19B5873B16ABA56063D5953F91DAEC0F0C01D73881341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 15KB
SHA256 35c74fa14191b6a0b698977e7baff1b0c11224cef35ab6602d09f461035d681f
MD5 037fdbc1ef6f63bd8be8911f79bed0d4
SHA1 bbc29cb6959269d71b203ff89b0371dd0c267668
SHA512 b12e6d4dc37271dfbf9409514a1d255db95fc4567b1cf36bd71db369b6dac1117667c328580ae93149e7ebed6fc496b058c0c85d2a8bb6c825ad09698f8ba2c1
SSDEEP 384:z+aQikB+z/xvxjg/qhETNBSV0PXeeOhx9zJ:S/UxvxjgC+3uJFJ
TLSH
T105729E3B95383E2795F3E604BA5E1B5BCAF898B381C26EB44DAD1F0D16DB3C40302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590c6a.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State~RFe590c6a.TMP
Size 1KB
SHA256 58686a0b9ccf0aca6a8c1506f4ce33a69ce4cff98b6e1ef5f4d21df4b84a08ae
MD5 462348889678b1cf5a7fe573f84e8807
SHA1 1e9b01e8fc855863d48fff630638aaea39368e82
SHA512 73a58c8b8eed7ac5e3e8c1becfc221ef6d15884a4094814bbb74877848043a8fba45867e8bde6b42ac19bd5fc5959941276016aae076669cd1ec9bc9863a2de3
TLSH
T1882142B6D4205F329DD1135A714BBE671E60706382114E8069CD4B0D11D718C4716837
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5wfmfqjd.met.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wfmfqjd.met.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 294B
SHA256 14420ee3b961a37e1fcde411de416e8fd9daafafa556ede49e5f560876853d6a
MD5 d79cd21e3c8272666700cbf914d4d60f
SHA1 cc87be37a0ef7848b048fe946881dc7af5856db0
SHA512 09e264c1ff41696b948597f11af6fb6bc286ad195812b5d1ae91656841f2bf655b7730eb1e9786d0e3ab4660acb0f8ce7e1212c2594e35b3621f8f1e36927875
TLSH
T133E07D725AE4135D07AB40D7C28B17B30C792044332B4A5033F846D81D50565433D1B8
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 944B
SHA256 f401464751ea8c263f258bf0b8f94f99a9e85fd856b819cb1d52b72f1ff13031
MD5 640a5ba5e8c9c917c11ee94c378f7df5
SHA1 6f2eb4ab052d686efde31d2a6cd295643778fd40
SHA512 8b674c6adca7cad936bd5fb96c02d879723678aa8251f50c5de65e396742217f7a230c509deffdbce4b0b36e114d1539f1df5a490b452635a59f65a12b68a55a
TLSH
T10F11216205B10679479F44CB6087D2E3992D28D5330705FE22E89FFC3893184C37E56D
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 1KB
SHA256 86ff62861f7567341edf722b6dd06419d5b1e9dc4068a73efd4ebfe6e971305d
MD5 f248aebd7c4266b3facf379cf17a8753
SHA1 0c3300447a30c61fddc77a26bcd74408a651392d
SHA512 34cb96c0896b2e0894f7ada2aea9c6a68e5d4cdfc4a79f00a599e6bbddb7df1a2796154ddd275678d7774adafc07f7df8eccebbb99f066a5ed9e7af0a1e126b7
TLSH
T1C131620310714679029F149B108299A751BC2CC5338F13EEEAA87FE8B88358A837ED99
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_ui.html

Path C:\Users\Admin\AppData\Local\Temp\aspas_ui.html
Size 2.4MB
SHA256 721bbaceccbd32bd0d31f0b53b206e703d3f049d03015500cd3bc5295e553bb5
MD5 0fe45244e3e3f454822ce2a6a87cd906
SHA1 5f0619b5a62f5fd604199d4b563e542afccd5dfd
SHA512 45648e289f5e138effcfb549523fdfecc7c0f47abb44a9f89c0c155849f1416050db757d78d21d5e08460041e320d59cd12ee71ceface3177ee54a4baf5248fb
SSDEEP 24576:FnWZc0KM5eBbkgIbtpmBWapavA9OSE89nBr+dpTcXg7cWZc0KM5eBbkgIbtpmBWE:FnMKM5i0hYBKWsRGMKM5i0hYBKWsRk
TLSH
T1D7C5122015F31976006B80ADAF979B0B3F699603850AC1FC3AEC47D94FCBD56CA2796D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_110205762\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-171-0x000002B4EFCE0000-0x000002B4EFD02000-memory.dmp

Download

memory/936-175-0x000002B4F0AA0000-0x000002B4F0FC8000-memory.dmp

Download

memory/936-172-0x000002B4F03A0000-0x000002B4F0562000-memory.dmp

Download

memory/3064-292-0x00007FFB49D30000-0x00007FFB49D31000-memory.dmp

Download

memory/3064-291-0x00007FFB4B170000-0x00007FFB4B171000-memory.dmp

Download

memory/4132-226-0x000002B850F80000-0x000002B850FAF000-memory.dmp

Download

memory/4132-24-0x00007FFB4AB50000-0x00007FFB4AB51000-memory.dmp

Download

memory/4660-205-0x00000214FF610000-0x00000214FF62E000-memory.dmp

Download

memory/4760-99-0x00007FFB4AB50000-0x00007FFB4AB51000-memory.dmp

Download

memory/5176-196-0x000001A574A80000-0x000001A574AA4000-memory.dmp

Download

memory/5176-195-0x000001A574A80000-0x000001A574AAA000-memory.dmp

Download

memory/5176-194-0x000001A5748F0000-0x000001A5748FA000-memory.dmp

Download

memory/5176-193-0x000001A574500000-0x000001A5745B2000-memory.dmp

Download

memory/5176-192-0x000001A5744D0000-0x000001A5744EE000-memory.dmp

Download