42e93cefc36e534d2f3303631319d7547e98e00a005df250d3aaeed1a954dc77

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 4.1MB
Sample260730-qyt8csszgx
SHA256 42e93cefc36e534d2f3303631319d7547e98e00a005df250d3aaeed1a954dc77
MD5 7797547ad692829e91acadab30fd9d16
SHA1 a59f061893dad55fca2070913751f7da9edd8d61
SHA512 7534b4f9001ca70351460f390cd2caf72837ccc75147f0f40ea159d632de64d7a9833032e370a37e9c327ea0911b060b374fdfa346dd0de6afc71dd12e91745a
SSDEEP 49152:f49l6dE/KrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtcT:02drzwUI5o9NniEoqDL412gF2eQP1I
TLSH
T15116E1A299C0E15CC663C2704D1B71019619B2FB27F8B5CABADE456DAF11F81CD37B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4604	msedgewebview2.exe
6032	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_343783230\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_343783230\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_343783230\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2044074332\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2044074332\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4604_2044074332\manifest.fingerprint	msedgewebview2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5704	powershell.exe
5704	powershell.exe
5704	powershell.exe
2496	powershell.exe
2496	powershell.exe
2496	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
4604	msedgewebview2.exe
4604	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4604	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe
Token: SeRemoteShutdownPrivilege	2052	powershell.exe
Token: SeUndockPrivilege	2052	powershell.exe
Token: SeManageVolumePrivilege	2052	powershell.exe
Token: 33	2052	powershell.exe
Token: 34	2052	powershell.exe
Token: 35	2052	powershell.exe
Token: 36	2052	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeIncreaseQuotaPrivilege	4308	powershell.exe
Token: SeSecurityPrivilege	4308	powershell.exe
Token: SeTakeOwnershipPrivilege	4308	powershell.exe
Token: SeLoadDriverPrivilege	4308	powershell.exe
Token: SeSystemProfilePrivilege	4308	powershell.exe
Token: SeSystemtimePrivilege	4308	powershell.exe
Token: SeProfSingleProcessPrivilege	4308	powershell.exe
Token: SeIncBasePriorityPrivilege	4308	powershell.exe
Token: SeCreatePagefilePrivilege	4308	powershell.exe
Token: SeBackupPrivilege	4308	powershell.exe
Token: SeRestorePrivilege	4308	powershell.exe
Token: SeShutdownPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeSystemEnvironmentPrivilege	4308	powershell.exe
Token: SeRemoteShutdownPrivilege	4308	powershell.exe
Token: SeUndockPrivilege	4308	powershell.exe
Token: SeManageVolumePrivilege	4308	powershell.exe
Token: 33	4308	powershell.exe
Token: 34	4308	powershell.exe
Token: 35	4308	powershell.exe
Token: 36	4308	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeIncreaseQuotaPrivilege	6060	powershell.exe
Token: SeSecurityPrivilege	6060	powershell.exe
Token: SeTakeOwnershipPrivilege	6060	powershell.exe
Token: SeLoadDriverPrivilege	6060	powershell.exe
Token: SeSystemProfilePrivilege	6060	powershell.exe
Token: SeSystemtimePrivilege	6060	powershell.exe
Token: SeProfSingleProcessPrivilege	6060	powershell.exe
Token: SeIncBasePriorityPrivilege	6060	powershell.exe
Token: SeCreatePagefilePrivilege	6060	powershell.exe
Token: SeBackupPrivilege	6060	powershell.exe
Token: SeRestorePrivilege	6060	powershell.exe
Token: SeShutdownPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeSystemEnvironmentPrivilege	6060	powershell.exe
Token: SeRemoteShutdownPrivilege	6060	powershell.exe
Token: SeUndockPrivilege	6060	powershell.exe
Token: SeManageVolumePrivilege	6060	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4604	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	90
PID 4604 wrote to memory of 4476	4604	msedgewebview2.exe	91
PID 4604 wrote to memory of 2192	4604	msedgewebview2.exe	92
PID 4604 wrote to memory of 2192	4604	msedgewebview2.exe	92
PID 4604 wrote to memory of 2192	4604	msedgewebview2.exe	92
PID 4604 wrote to memory of 2192	4604	msedgewebview2.exe	92
PID 4604 wrote to memory of 5112	4604	msedgewebview2.exe	93
PID 4604 wrote to memory of 2384	4604	msedgewebview2.exe	94
PID 4604 wrote to memory of 2384	4604	msedgewebview2.exe	94
PID 4604 wrote to memory of 2384	4604	msedgewebview2.exe	94
PID 4604 wrote to memory of 6032	4604	msedgewebview2.exe	95
PID 4604 wrote to memory of 6032	4604	msedgewebview2.exe	95
PID 4604 wrote to memory of 6032	4604	msedgewebview2.exe	95
PID 4604 wrote to memory of 6032	4604	msedgewebview2.exe	95
PID 4604 wrote to memory of 6032	4604	msedgewebview2.exe	95
PID 2600 wrote to memory of 5704	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	96
PID 5704 wrote to memory of 6128	5704	powershell.exe	98
PID 5704 wrote to memory of 5812	5704	powershell.exe	99
PID 2600 wrote to memory of 2496	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	100
PID 2600 wrote to memory of 2052	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	102
PID 2600 wrote to memory of 4308	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	104
PID 2600 wrote to memory of 6060	2600	2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	108
PID 4604 wrote to memory of 5700	4604	msedgewebview2.exe	113
PID 4604 wrote to memory of 5700	4604	msedgewebview2.exe	113
PID 4604 wrote to memory of 5700	4604	msedgewebview2.exe	113
PID 4604 wrote to memory of 4540	4604	msedgewebview2.exe	114
PID 4604 wrote to memory of 4540	4604	msedgewebview2.exe	114
PID 4604 wrote to memory of 4540	4604	msedgewebview2.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-gpu --disable-gpu-compositing --enable-features=MojoIpcz --remote-debugging-port=9222 --mojo-named-platform-channel-pipe=2600.3128.1944603880382947455 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView /prefetch:4 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb0cd75fd8,0x7ffb0cd75fe4,0x7ffb0cd75ff0
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1728 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1820 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:6032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-07-30_7797547ad692829e91acadab30fd9d16_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1384,i,4210465139435600564,13692289463847390294,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:4540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJAB0AGMAcABHAGwAbwBiAGEAbAAgAD0AIABuAGUAdABzAGgAIABpAG4AdAAgAHQAYwBwACAAcwBoAG8AdwAgAGcAbABvAGIAYQBsADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGUAIABpAG4AIAAkAHQAYwBwAEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlAC0AUwBpAGQAZQAgAFMAYwBhAGwAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBzACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlACAAUwBlAGcAbQBlAG4AdAAgAEMAbwBhAGwAZQBzAGMAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBjACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBDAGgAaQBtAG4AZQB5ACAATwBmAGYAbABvAGEAZAAgAFMAdABhAHQAZQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAYwBoAGkAbQBuAGUAeQAnAF0AIAA9ACAAJABNAGEAdABjAGgAZQBzAFsAMQBdACAAfQAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBuAGUAIAAtAG0AYQB0AGMAaAAgACcATgBlAHQARABNAEEAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AZQB0AGQAbQBhACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBOAG8AbgAgAFMAYQBjAGsAIABSAHQAdAAgAFIAZQBzAGkAbABpAGUAbgBjAHkAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AbwBuAHMAYQBjAGsAJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAAgACAAIAAgAGkAZgAgACgAJABsAGkAbgBlACAALQBtAGEAdABjAGgAIAAnAEUAQwBOACAAQwBhAHAAYQBiAGkAbABpAHQAeQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAZQBjAG4AJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAB9ACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACAAPQAgAG4AZQB0AHMAaAAgAGkAbgB0ACAAaQBwAHYANAAgAHMAaABvAHcAIABnAGwAbwBiAGEAbAA7ACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBlACAAaQBuACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBEAGUAZgBhAHUAbAB0ACAASABvAHAAIABMAGkAbQBpAHQAXABzACoAOgBcAHMAKgAoAFwAZAArACkAJwApACAAewAgACQAcgBlAHMAWwAnAGgAbwBwACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAfQAgACQAdABjAHAAaQBwAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFQAYwBwAGkAcABcAFAAYQByAGEAbQBlAHQAZQByAHMAJwA7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHQAYwBwAGkAcABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAHIAZQBzAFsAJwBEAGkAcwBhAGIAbABlAFQAYQBzAGsATwBmAGYAbABvAGEAZAAnAF0AIAA9ACAAaQBmACAAKAAkAHQAYwBwAGkAcABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4AUABTAE8AYgBqAGUAYwB0AC4AUAByAG8AcABlAHIAdABpAGUAcwBbACcARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAJwBdACkAIAB7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4ARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAHIAZQBzAFsAJwBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJAB0AGMAcABpAHAAUAByAG8AcABzACAALQBhAG4AZAAgACQAdABjAHAAaQBwAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEUAbgBhAGIAbABlAFcAYQBuAG4AYQBPAHUAdABjAG8AbQBpAG4AZwAnAF0AKQAgAHsAIAAkAHQAYwBwAGkAcABQAHIAbwBwAHMALgBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAGEAZgBkAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAEEARgBEAFwAUABhAHIAYQBtAGUAdABlAHIAcwAnADsAIAAkAGEAZgBkAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABhAGYAZABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAGEAZgBkAEsAZQB5AHMAIAA9ACAAQAAoACcARABlAGYAYQB1AGwAdABSAGUAYwBlAGkAdgBlAFcAaQBuAGQAbwB3ACcALAAgACcARABlAGYAYQB1AGwAdABTAGUAbgBkAFcAaQBuAGQAbwB3ACcALAAgACcAQgB1AGYAZgBlAHIATQB1AGwAdABpAHAAbABpAGUAcgAnACwAIAAnAEIAdQBmAGYAZQByAEEAbABpAGcAbgBtAGUAbgB0ACcALAAgACcARABvAE4AbwB0AEgAbwBsAGQATgBJAEMAQgB1AGYAZgBlAHIAcwAnACwAIAAnAFQAcgBhAG4AcwBtAGkAdABXAG8AcgBrAGUAcgAnACwAIAAnAFAAcgBpAG8AcgBpAHQAeQBCAG8AbwBzAHQAJwAsACAAJwBTAG0AYQBsAGwAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAFMAaQB6AGUAJwAsACAAJwBMAGEAcgBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAEgAdQBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAFMAbQBhAGwAbABCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAEwAaQBzAHQARABlAHAAdABoACcALAAgACcATABhAHIAZwBCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAQQBkAGQAcgBlAHMAcwBTAGgAYQByAGkAbgBnACcALAAgACcARABpAHMAYQBiAGwAZQBDAGgAYQBpAG4AZQBkAFIAZQBjAGUAaQB2AGUAJwAsACAAJwBEAGkAcwBhAGIAbABlAEQAaQByAGUAYwB0AEEAYwBjAGUAcAB0AEUAeAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAUgBhAHcAUwBlAGMAdQByAGkAdAB5ACcALAAgACcARAB5AG4AYQBtAGkAYwBTAGUAbgBkAEIAdQBmAGYAZQByAEQAaQBzAGEAYgBsAGUAJwAsACAAJwBGAGEAcwB0AFMAZQBuAGQARABhAHQAYQBnAHIAYQBtAFQAaAByAGUAcwBoAG8AbABkACcALAAgACcARgBhAHMAdABDAG8AcAB5AFIAZQBjAGUAaQB2AGUAVABoAHIAZQBzAGgAbwBsAGQAJwAsACAAJwBJAGcAbgBvAHIAZQBQAHUAcwBoAEIAaQB0AE8AbgBSAGUAYwBlAGkAdgBlAHMAJwAsACAAJwBJAGcAbgBvAHIAZQBPAHIAZABlAHIAbAB5AFIAZQBsAGUAYQBzAGUAJwApADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGEAZgBkAEsAZQB5AHMAKQAgAHsAIAAgACAAIAAgAGkAZgAgACgAJABhAGYAZABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJABhAGYAZABQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJABrAF0AKQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAJABhAGYAZABQAHIAbwBwAHMALgAkAGsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAIgAiACAAfQAgAH0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHIAZQBzACAALQBDAG8AbQBwAHIAZQBzAHMA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6128
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int ipv4 show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5812
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJABmAG0AUABhAHQAaAAgAD0AIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAEMAaQB0AGkAegBlAG4ARgBYAFwARgBpAHYAZQBNACcAOwAgACQAZgBtAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABmAG0AUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcAQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACcAXQAgAD0AIABpAGYAIAAoACQAZgBtAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGYAbQBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAEUARgBIAGEAcgBkAHcAYQByAGUAQQBjAGMAZQBsAGUAcgBhAHQAaQBvAG4AJwBdACkAIAB7ACAAJABmAG0AUAByAG8AcABzAC4AQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAJABmAG0AUAByAGkAUABhAHQAaAAgAD0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbQBhAGcAZQAgAEYAaQBsAGUAIABFAHgAZQBjAHUAdABpAG8AbgAgAE8AcAB0AGkAbwBuAHMAXABGAGkAdgBlAE0ALgBlAHgAZQBcAFAAZQByAGYATwBwAHQAaQBvAG4AcwAnADsAIAAkAGYAbQBQAHIAaQBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAZgBtAFAAcgBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACQAcgBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACAAPQAgAGkAZgAgACgAJABmAG0AUAByAGkAUAByAG8AcABzACAALQBhAG4AZAAgACQAZgBtAFAAcgBpAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACkAIAB7ACAAJABmAG0AUAByAGkAUAByAG8AcABzAC4AQwBwAHUAUAByAGkAbwByAGkAdAB5AEMAbABhAHMAcwAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0AOwAgACQAdABpAG0AZQByAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABTAGUAcwBzAGkAbwBuACAATQBhAG4AYQBnAGUAcgBcAGsAZQByAG4AZQBsACcAOwAgACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJAB0AGkAbQBlAHIAUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACcAXQAgAD0AIABpAGYAIAAoACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAHQAaQBtAGUAcgBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBHAGwAbwBiAGEAbABUAGkAbQBlAHIAUgBlAHMAbwBsAHUAdABpAG8AbgBSAGUAcQB1AGUAcwB0AHMAJwBdACkAIAB7ACAAJAB0AGkAbQBlAHIAUAByAG8AcABzAC4ARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand dAByAHkAIAB7ACAAIAAgACAAIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAEgAQQBSAEQAVwBBAFIARQBcAEQARQBTAEMAUgBJAFAAVABJAE8ATgBcAFMAeQBzAHQAZQBtAFwAQgBJAE8AUwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBCAGEAcwBlAEIAbwBhAHIAZABQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBHAGUAbgBlAHIAaQBjACAATQBvAHQAaABlAHIAYgBvAGEAcgBkACIAIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABsAGkAcwB0ACAAPQAgAEAAKAApADsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJABmAGEAbABzAGUAOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBQAGgAeQBzAGkAYwBhAGwAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA7AEcAdQBpAGQAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAfQAgACAAIAAgACAAIAAgACAAIAB9ACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABsAGkAcwB0AC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAJABzAHUAYwBjAGUAcwBzACAAPQAgACQAdAByAHUAZQAgAH0AIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ADsAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHMAdQBjAGMAZQBzAHMAKQAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGEAZAAgAGkAbgAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAFAAaAB5AHMAaQBjAGEAbABBAGQAYQBwAHQAZQByAD0AVAByAHUAZQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGEAZAAuAE4AZQB0AEMAbwBuAG4AZQBjAHQAaQBvAG4ASQBEADsARABlAHMAYwA9ACQAYQBkAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuADsARwB1AGkAZAA9ACQAYQBkAC4ARwBVAEkARAB9ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBzAHQALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJAB0AHIAdQBlACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AQwBsAGEAcwBzACAAVwBpAG4AMwAyAF8ATgBlAHQAdwBvAHIAawBBAGQAYQBwAHQAZQByACAALQBGAGkAbAB0AGUAcgAgACIAUABoAHkAcwBpAGMAYQBsAEEAZABhAHAAdABlAHIAPQBUAHIAdQBlACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBlAHQAQwBvAG4AbgBlAGMAdABpAG8AbgBJAEQAOwBEAGUAcwBjAD0AJABhAGQALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AOwBHAHUAaQBkAD0AJABhAGQALgBHAFUASQBEAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbABpAHMAdAAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAApACAAewAgACQAcwB1AGMAYwBlAHMAcwAgAD0AIAAkAHQAcgB1AGUAIAB9ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQA7ACAAaQBmACAAKAAtAG4AbwB0ACAAJABzAHUAYwBjAGUAcwBzACkAIAB7ACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbgBuAHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABOAGUAdAB3AG8AcgBrAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAQgBFADEAMAAzADEAOAB9ACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGMAIABpAG4AIAAkAGMAbwBuAG4AcwApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG4AbgBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIAJAAoACQAYwAuAFAAUwBQAGEAdABoACkAXABDAG8AbgBuAGUAYwB0AGkAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAG8AbgBuAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEcAdQBpAGQAPQAkAGMALgBQAFMAQwBoAGkAbABkAE4AYQBtAGUAfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgACQAbABpAHMAdAAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABnAHUAaQBkACAAPQAgACIAewA4ADIANQA4AEIARAAyADcALQBGADgAMgAxAC0ANABGADEAMgAtAEIARABDADcALQBEADkANgBDAEIANgA5ADcAMAA0AEYAQwB9ACIAOwAgACQAZABlAHMAYwAgAD0AIAAiAFIAZQBhAGwAdABlAGsAIABSAFQATAA4ADEAMwA5AEMAKwAgAEYAYQBzAHQAIABFAHQAaABlAHIAbgBlAHQAIABOAEkAQwAiADsAIAAkAHMAdQBiACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEMAbABhAHMAcwBcAHsANABEADMANgBFADkANwAyAC0ARQAzADIANQAtADEAMQBDAEUALQBCAEYAQwAxAC0AMAA4ADAAMAAyAGIARQAxADAAMwAxADgAfQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAFAAUwBDAGgAaQBsAGQATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeAFwAZAB7ADQAfQAkACcAIAB9ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAXwAuAFAAUwBQAGEAdABoACAALQBOAGEAbQBlACAAIgBOAGUAdABDAGYAZwBJAG4AcwB0AGEAbgBjAGUASQBkACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAE4AZQB0AEMAZgBnAEkAbgBzAHQAYQBuAGMAZQBJAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAAUABTAEMAaABpAGwAZABOAGEAbQBlADsAIAAkAHIAZQBzACAAPQAgAEAAewB9ADsAIABpAGYAIAAoACQAcwB1AGIAKQAgAHsAIAAgACAAIAAgACQAYQBwACAAPQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAYgBFADEAMAAzADEAOAB9AFwAJABzAHUAYgAiADsAIAAgACAAIAAgACQAcAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAIAAgACAAIAAkAGsAZQB5AHMAIAA9ACAAQAAoACcAKgBGAGwAbwB3AEMAbwBuAHQAcgBvAGwAJwAsACAAJwAqAEkAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBMAHMAbwBWADIASQBQAHYANAAnACwAIAAnACoATABzAG8AVgAyAEkAUAB2ADYAJwAsACAAJwAqAFAAcgBpAG8AcgBpAHQAeQBWAEwAQQBOAFQAYQBnACcALAAgACcAKgBJAG4AdABlAHIAcgB1AHAAdABNAG8AZABlAHIAYQB0AGkAbwBuACcALAAgACcASQBUAFIAJwAsACAAJwAqAFAAYQBjAGsAZQB0AEQAaQByAGUAYwB0ACcALAAgACcAKgBSAGUAYwBlAGkAdgBlAEIAdQBmAGYAZQByAHMAJwAsACAAJwAqAFQAcgBhAG4AcwBtAGkAdABCAHUAZgBmAGUAcgBzACcALAAgACcAVAB4AEkAbgB0AEQAZQBsAGEAeQAnACwAIAAnAEMAbwBhAGwAZQBzAGMAZQBCAHUAZgBmAGUAcgBTAGkAegBlACcALAAgACcAKgBQAE0AQQBSAFAATwBmAGYAbABvAGEAZAAnACwAIAAnACoAUABNAE4AUwBPAGYAZgBsAG8AYQBkACcAKQA7ACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGsAZQB5AHMAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAGsAXQApACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAkAHAAcgBvAHAAcwAuACQAawAgAH0AIABlAGwAcwBlACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAiACIAIAB9ACAAIAAgACAAIAB9ACAAIAAgACAAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ASQBuAHQAZQByAGYAYQBjAGUARABlAHMAYwByAGkAcAB0AGkAbwBuACAAJABkAGUAcwBjACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBQAG4AcABJAEQAOwAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwAG4AcABJAGQAKQAgAHsAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0AUABoAHkAcwBpAGMAYQBsACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AKQAuAFAAbgBwAEkARAA7ACAAfQAgACAAIAAgACAAaQBmACAAKAAkAHAAbgBwAEkAZAApACAAewAgACAAIAAgACAAIAAgACAAIAAkAG0AcwBpAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEUAbgB1AG0AXAAkAHAAbgBwAEkAZABcAEQAZQB2AGkAYwBlACAAUABhAHIAYQBtAGUAdABlAHIAcwBcAEkAbgB0AGUAcgByAHUAcAB0ACAATQBhAG4AYQBnAGUAbQBlAG4AdABcAE0AZQBzAHMAYQBnAGUAUwBpAGcAbgBhAGwAZQBkAEkAbgB0AGUAcgByAHUAcAB0AFAAcgBvAHAAZQByAHQAaQBlAHMAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAbQBzAGkAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAG0AcwBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbQBzAGkAUAByAG8AcABzACkAIAB7ACAAJAByAGUAcwBbACcATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAJwBdACAAPQAgACQAbQBzAGkAUAByAG8AcABzAC4ATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJwBNAFMASQBTAHUAcABwAG8AcgB0AGUAZAAnAF0AIAA9ACAAIgAiACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUABhAHQAaAAgAD0AIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwARQBuAHUAbQBcACQAcABuAHAASQBkAFwARABlAHYAaQBjAGUAIABQAGEAcgBhAG0AZQB0AGUAcgBzAFwASQBuAHQAZQByAHIAdQBwAHQAIABNAGEAbgBhAGcAZQBtAGUAbgB0AFwAQQBmAGYAaQBuAGkAdAB5ACAAUABvAGwAaQBjAHkAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAZgBmAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYQBmAGYAUAByAG8AcABzACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUAByAGkAbwByAGkAdAB5ACcAXQAgAD0AIAAkAGEAZgBmAFAAcgBvAHAAcwAuAEQAZQB2AGkAYwBlAFAAcgBpAG8AcgBpAHQAeQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACQAYQBmAGYAUAByAG8AcABzAC4ARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAOwAgACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBEAGUAdgBpAGMAZQBQAHIAaQBvAHIAaQB0AHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgAH0AIAAgACAAIAAgACQAbgBlAHQASQBwACAAPQAgAEcAZQB0AC0ATgBlAHQASQBQAEkAbgB0AGUAcgBmAGEAYwBlACAALQBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAkAGQAZQBzAGMAIAAtAEEAZABkAHIAZQBzAHMARgBhAG0AaQBsAHkAIABJAFAAdgA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAgACAAIAAgAGkAZgAgACgAJABuAGUAdABJAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQB0AHUAJwBdACAAPQAgACQAbgBlAHQASQBwAC4ATgBsAE0AdAB1ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAYQBkAHYAUgBvAHUAdABlACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGUARABlAGYAYQB1AGwAdABSAG8AdQB0AGUAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBhAGQAdgBlAHIAdABpAHMAaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAGQAdgBlAHIAdABpAHMAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGkAbgBnACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQBlAHQAcgBpAGMAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAHUAdABvAG0AYQB0AGkAYwBNAGUAdAByAGkAYwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAG0AcwBzACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQwBsAGEAbQBwAE0AcwBzACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAZgBvAHIAdwBhAHIAZABpAG4AZwAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEYAbwByAHcAYQByAGQAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4ARgBvAHIAdwBhAHIAZABpAG4AZwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAGkAZwBuAG8AcgBlAFIAbwB1AHQAZQAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEkAZwBuAG8AcgBlAEQAZQBmAGEAdQBsAHQAUgBvAHUAdABlAHMAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAG8AdQB0AGUAcgBEAGkAcwBjACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBiAGEAcwBlAFIAZQBhAGMAaAAnAF0AIAA9ACAAJABuAGUAdABJAHAALgBCAGEAcwBlAFIAZQBhAGMAaABhAGIAbABlAFQAaQBtAGUAOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAGUAdAByAGEAbgBzACcAXQAgAD0AIAAkAG4AZQB0AEkAcAAuAFIAZQB0AHIAYQBuAHMAbQBpAHQAVABpAG0AZQA7ACAAIAAgACAAIAB9ACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2ad21a8478c318810663631ac97d10409272c849cd9d3a56fae76815c3f77386
MD5 7f8885acc1ada31457e8828edd40fd1d
SHA1 e88e548c5010a7a84ee8528c819ce632c875072b
SHA512 c09f726b47eeeea2cb3e2f9aa91ca873c8be2e0bb41674f7f564a5c41ed65d9ab19058f32701a5bf267f0b37a36cf036d1d6719b029897394d6cd85b0d86af70
TLSH
T1F731CE37B7CC4695C85E443600CD9C1032F586DB80DEDF9BB741D445792F5C4DE64950
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2824b482f7610b74c62c55fad175524279c184a1ee8af5c212db1842303f47f4
MD5 dfc4e094c64810f639df33efeca60fed
SHA1 7d9aeaf843fdadc8ed8497052e7f2d082634d039
SHA512 241d71c77888e5080db9564b6eed392af510af89af45d03d397fa23339ff849e0164a45c26395a00d2e7178461609e8607686a9b6ec6c65d270f26b8f98b3110
TLSH
T15931023BB3CD4266C855483650CDAC1031B5C3DB87DEDF9BBB81D545B92FA84DE64050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e562445977d07f3de1f57bd30e41366f9a57f192255910b815021817ad792311
MD5 36ee23059a2153bde171711bc27b50ec
SHA1 3e252e3526b9c9fc6cb9110a8b92551ea912e27e
SHA512 f873e875fd134332cfeed3138948b787b0e81c0369ce610323a72634d89d280c3fbbe2537ad98beb4845dc77cf574e809a3a868191c7fab528f593b20d0ddefb
TLSH
T12D216837F3DC8214C89A413A10DDAC1436B6C7DB80DECF9B6B85E159A82F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 412cfac8577f8ef567109527083ef0ae2a5f2e3e4843f9faa8b2bb4014b6a68e
MD5 eb6bd84e32c20b1ac21b9b5c3ce1eaa6
SHA1 8b0a3779619b9ce666d47d403dd44d0a779944a0
SHA512 4bd23455f6a38389e33d848570fb06aeed5f7226a00f7d406d52322fc21f54ae8676daa45cf0e947b43d0dbef8126ba9cff05406a4fee9550eedc6ac04f8ac3e
TLSH
T1E531BF6BB3DC8556C899403610C9A85032BE87DB819F8F977A81D145F43F389DE64394
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1b427d252e5de52d14df3e30f5b3e64b9ed6f23609507e24b6dd33c89195a6ec
MD5 593e9854865e38a6310b85af28368885
SHA1 4d7888614f7399d9975f78046cc1fb85159c41f9
SHA512 5f691cee1299706c96ce7d77988d9350a12c12efa0f4a5aa5e73484326471dc6e7d6ce744dfb73fea94f4bdb5309dbf9db0461bf51a211bfc75ee6385b0b63d9
TLSH
T17DD01222B3910538C1103033050261092C40C11F50054411A46A861D1E544942903441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 49814514509746a5d44518f51dd6e1fea3b29ef06b0bd96f9580e876a137a6ef
MD5 8f0c2e761cf7cf347f834fbc04d49afc
SHA1 4c1cfcb032f55142e892c6ca03d31f5ecfcc3ae7
SHA512 098bac4047e9b6aab3894244782ddea5c2cce6f804bf77b752fc3544dfff132499aeb92235f8f2e8cd955d2d37bbbfaef4148dd8c5b66a101087f61a623754c3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 7bbc1399c0a63a3142403f0931c7f1a0f9a170a4a0e923d8f5d8f5057c456ca4
MD5 5071844855a32487a252be7fe395ffc4
SHA1 033ac1af07a2a963cd77bd5201c11ccfff5a75eb
SHA512 cd44707cc21c468d47873a244035708761e3f787b41651c612c4c41d6a4a7aa15884ffaa0f235c2a37420c80b90aac54df492563906f9d20e29fff21a69d4dfd
TLSH
T1F94147BAC3D8437E989112F92B356926CD2E555B46383C178DE5AF8F27E14B0D30129F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 1089b38f07857ff38fe4280eda2fcf9a9995b7f7ebaa358f58134f5cab6c58fc
MD5 1bf3d2c1df16fe65758d25b81a47e206
SHA1 8a70182c0c28dcc0c60a2edd79849513feadcb71
SHA512 37442ac734aab333d6fd75e33b62b57d81bab2d5a4d9db23aa4faeea3c412dbbcbae016cf95763650eba066e3ae392de6bbbfa7e8b2e09bed5b512c7ba1ce1be
SSDEEP 96:stv/dDvYRb9Gkwo5h16Zdas7/x+6MhmuecmADvZhIeWK+g+L28XM1C7K:st3hRVosasV+FiADvZhIysLG6K
TLSH
T1D5D1A6175B28697B4CC6E619FA29B716D2F56032A5D01E94EBF8861C08DB5DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 c0d33258f85d943f4e823d7d2eff2ff33d316ddc967bf854ed2f02d96d6aee61
MD5 bf1db8785202cdc5755d9d54b655fbb8
SHA1 e82fda600327c71e93a323435f533586dc0a129d
SHA512 cf8c15e427cf209a4cdac7f49d22f657439c16ec65f168430b1b18210559d9c7cb00bd50dff402585a4f2c9e1a36c122d844f4503f17c04017b6bb5326cb275a
SSDEEP 96:stv/dDvvGRb9Gkwo5h16Zdas7/x+6MhmuecmADvZhIeWK+g+Q28XM1C7K:st3hbVosasV+FiADvZhIysQG6K
TLSH
T1FDD1B8175B24697B4CC6E619FA29BB17D2F56032A5D01E98EBFC861C08DB9DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c588.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences~RFe59c588.TMP
Size 6KB
SHA256 2338dcc188a0ab70f9a99eb481bf7aaea76d4b0e8c9ff910cf6c0d1281c4a1aa
MD5 a863f2c1bcc60511d93d1d1771c096cf
SHA1 b9a99b10a110a07ea39447389c912bdb6c475711
SHA512 22d3ed66365ea7e7df49e0c9a546b26254a625492999386ab7f230424e802eee269cbe105aea09957ea1c2cc6f42db85af0238c970fc8fb92e5da12c931d1a78
SSDEEP 96:rv/dDvYRb9GkKdo616Zdas7/x+6MhmuecmADvZhIeWK+g+L28XM1C7K:r3hRzoPasV+FiADvZhIysLG6K
TLSH
T1A7D1B6075B28697F4CC6E619FA29B716D2F55032B5D41E98E7F8861C08DB9DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 3b7fbe536053a12bed71d97d18509a3a838bbfa73247a94fe4325bce3845bdad
MD5 26244918c8081b45f1ece562a7cf7c46
SHA1 0611b5d126b2ff7a5106f58e0cd22a9eb7364406
SHA512 814f4da45ab4bb604b511d2ea402259109b2dc5b511c8c80faa2e4a4258d3b670c8d9d0db1822f6370b564b5e24ad57f5902be7c0e801c0ed16af4f54532929e
TLSH
T16081732B7A74AA378EF2D609B98A3B13AB645063D5C17F94D9EC0F0D01D7389138281B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 2KB
SHA256 26522f4d0a3bf19bace40af3781b535aaac5e0dbc4713af24ff56f9bb47fc417
MD5 ecded9420f7f59ddeddae05d4b55095f
SHA1 b3a5e7a2a4d8d0d11c9335a92db892964e1c9ca0
SHA512 7dc84fd2454ac1a7add3f308c6bd1e3f336dfb32fbaf71067c244ca4e1fdf8973ab4861ee538d6c142584eb2c34e8c080c60b21f423c1d744a22cc604f5efc48
TLSH
T1E351513379249B338AF29718B94F7F239E395191DB926F0099DC0B0D00D665D2382C6B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 4cfdba18e2a74f0b55547367a7b220893315c810d168e697b08bc06c9b81b840
MD5 2ad30e1210b1b38a1b2bf98d012cc20d
SHA1 4033774d454b760b54c8cd0d82d1bce5e0959050
SHA512 efe1699b9015459c814147a59933ffcacb47b4b4cb695f58fd10f94343c2d749d9f7bfe398938e61993e5a0cdc67eee0cccc4ffa4fcddcaae5de4102e4633ddd
TLSH
T1DB61633B7974DA278EF29A05B98A3B12BB655163E6D17F54D9EC0F0D01D73881382C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 15KB
SHA256 fb835db9919024907cfd6208e7ce4588eb2a3dca8d76e35128f561cc0cda1080
MD5 8568d29d5601076ed3f0c84a7d3abe39
SHA1 f54d01a4fc6bbfa59506923f47a4266b0f455cdf
SHA512 8d335852f0bc06cc11afc22a785a169353a3b47dfda874c7bf38b5844d94d115ca1b892f32f63ea3e9ae5e5ebe59f7dfff574569eadbfee75ab2ddd2a8bba69e
SSDEEP 384:Y+aQikB+z/xvxjg/qhExNBSeKUwzRisdK3kc9zX:X/UxvxjgC+FuRisoUcFX
TLSH
T17872AE3B65383E3396F7E605794D179BDBB894A291C2BE648AED5F0D09833D40342C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5958b5.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State~RFe5958b5.TMP
Size 1KB
SHA256 25c668c68b60e713ba2e6ecbaa050a599f62d521453cce4e9b348e97445d497e
MD5 1b78ba042ae41d83163ec6c7c1221569
SHA1 225389f0ded49bf828af6b83becd32e0e692938d
SHA512 62a91dea0bf65c844549ef64207abd7f4b16fed345059d82762beefad4ab32b9198e26b637177775452f75a972fbbfafc67bc3c5871eb97116e14abee02365f8
TLSH
T1C4216577B5A88B33EDE1A315764FBBA72E20105683509F0094CD4B0D01D214E579B937
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aenx4hcn.v2t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aenx4hcn.v2t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 294B
SHA256 b4b4b3d063df25233071444d6cfe02f34ea6a71882e841d72534a7e5ba1631b2
MD5 7eb3714ebd7273dd4a512813dae06e60
SHA1 d0cae8b3610af32c981f60fef0ecaa6d44b98274
SHA512 711eb703cc3a4cb72cdf0808ed16d4cfd87c37b66216508c824ce64cd2b54f2ae1ff44262f1e88774092b5fc07fc06639719e731d6eff9cae025790eb792368c
TLSH
T188E07D328AE0039907AB80E7C2DA13B20CBA144432274A5433B856D81990455433C1B9
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 944B
SHA256 08090b8f429f73c1216169aa8ffc01f4c777351222775623973348fa75dee547
MD5 87512b7174139ea03a3418c7485a6eaf
SHA1 fff27b949c85cbff0230204a3b9332636fdcb94a
SHA512 a6935b0c5bf50b0d509e3decad616d10155845e62c0f193e0fe5050b939a888428ac24fcf968449dd9126da2ceaf03e107c7791447311dbe665a51a9943c4cac
TLSH
T118110E6205710531479B41CB6282A2E3E4282ED9320745FE238C9FE828D3189C3BE96A
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 1KB
SHA256 a5cbb6dc4256b9e8ea7ef0b559c348a2b4e149c74b3c80582927f0d96d6f1bc9
MD5 64558a36d7a264a98ac27ef7e292e785
SHA1 e2bf70f13bf0157fa7dae5cd5800e3ce139b9c16
SHA512 b5706b888a2995cc7050b39e01e5ffac0f8a66eb6eaa25b80ba7fc418c5847c3a3fe98a5f40f4ca0139d018791289e43c88995e9111950dcbe562c9a96a7218b
TLSH
T1F831650300314235129B04DB25829997A1B82DCA334F03EEE7987FD8B4C398E837EDDA
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_ui.html

Path C:\Users\Admin\AppData\Local\Temp\aspas_ui.html
Size 2.4MB
SHA256 721bbaceccbd32bd0d31f0b53b206e703d3f049d03015500cd3bc5295e553bb5
MD5 0fe45244e3e3f454822ce2a6a87cd906
SHA1 5f0619b5a62f5fd604199d4b563e542afccd5dfd
SHA512 45648e289f5e138effcfb549523fdfecc7c0f47abb44a9f89c0c155849f1416050db757d78d21d5e08460041e320d59cd12ee71ceface3177ee54a4baf5248fb
SSDEEP 24576:FnWZc0KM5eBbkgIbtpmBWapavA9OSE89nBr+dpTcXg7cWZc0KM5eBbkgIbtpmBWE:FnMKM5i0hYBKWsRGMKM5i0hYBKWsRk
TLSH
T1D7C5122015F31976006B80ADAF979B0B3F699603850AC1FC3AEC47D94FCBD56CA2796D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-188-0x000002457DC20000-0x000002457DC44000-memory.dmp

Download

memory/2052-184-0x000002457D670000-0x000002457D68E000-memory.dmp

Download

memory/2052-187-0x000002457DC20000-0x000002457DC4A000-memory.dmp

Download

memory/2052-185-0x000002457D9E0000-0x000002457DA92000-memory.dmp

Download

memory/2052-186-0x000002457D6B0000-0x000002457D6BA000-memory.dmp

Download

memory/2192-21-0x00007FFB2D840000-0x00007FFB2D841000-memory.dmp

Download

memory/4308-197-0x0000021F25DD0000-0x0000021F25DEE000-memory.dmp

Download

memory/4540-343-0x000001B960E20000-0x000001B960E4F000-memory.dmp

Download

memory/5700-309-0x00007FFB2E470000-0x00007FFB2E471000-memory.dmp

Download

memory/5700-310-0x00007FFB2E830000-0x00007FFB2E831000-memory.dmp

Download

memory/5700-320-0x00000233C5100000-0x00000233C512F000-memory.dmp

Download

memory/5704-169-0x0000027D2B7D0000-0x0000027D2B7F2000-memory.dmp

Download

memory/5704-170-0x0000027D2BF20000-0x0000027D2C0E2000-memory.dmp

Download

memory/5704-171-0x0000027D2C620000-0x0000027D2CB48000-memory.dmp

Download

memory/6032-99-0x00007FFB2D840000-0x00007FFB2D841000-memory.dmp

Download