fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 4.2MB
Sample260801-dpafdadl8v
SHA256 fb17c29c1c6c6f6971d5f404006d7f51838729ff500bdc5961b2a4ed2e4a7a8e
MD5 6bb9096ac58e395cd5ce110536ade641
SHA1 9985bef67ba342bc5740ed78bd524ffe6c4b817e
SHA512 c341640b4b4e7f4ff67f53eecbc14d7f9cc54e1a7f873a1d3201c8a284304152b3fc67df97f27124decc84ec20e271b6c987d91f69e80fca3b57c55962c784c6
SSDEEP 49152:xHPjQGCiLS4zuBUgDJYk5SUYvJjw0wyiE5oqrHLJO1qKL+XJLA5Z/h92e9G6svtI:dS4zwUI5o9NfiEoqDL415gU2eQP1I
TLSH
T1CA16E1A299C0E05CC763C2704D1B71019619F6FB27F875CAAADE456DAF11F818E37B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 2 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4768	msedgewebview2.exe
5812	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1528202616\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1528202616\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_562399506\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_562399506\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1528202616\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1528202616\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1528202616\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_562399506\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_562399506\_metadata\verified_contents.json	msedgewebview2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
6112	powershell.exe
6112	powershell.exe
6112	powershell.exe
3604	powershell.exe
3604	powershell.exe
3604	powershell.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
2176	powershell.exe
2176	powershell.exe
2176	powershell.exe
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe
4768	msedgewebview2.exe
4768	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4768	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2944	powershell.exe
Token: SeSecurityPrivilege	2944	powershell.exe
Token: SeTakeOwnershipPrivilege	2944	powershell.exe
Token: SeLoadDriverPrivilege	2944	powershell.exe
Token: SeSystemProfilePrivilege	2944	powershell.exe
Token: SeSystemtimePrivilege	2944	powershell.exe
Token: SeProfSingleProcessPrivilege	2944	powershell.exe
Token: SeIncBasePriorityPrivilege	2944	powershell.exe
Token: SeCreatePagefilePrivilege	2944	powershell.exe
Token: SeBackupPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	2944	powershell.exe
Token: SeShutdownPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeSystemEnvironmentPrivilege	2944	powershell.exe
Token: SeRemoteShutdownPrivilege	2944	powershell.exe
Token: SeUndockPrivilege	2944	powershell.exe
Token: SeManageVolumePrivilege	2944	powershell.exe
Token: 33	2944	powershell.exe
Token: 34	2944	powershell.exe
Token: 35	2944	powershell.exe
Token: 36	2944	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeIncreaseQuotaPrivilege	2176	powershell.exe
Token: SeSecurityPrivilege	2176	powershell.exe
Token: SeTakeOwnershipPrivilege	2176	powershell.exe
Token: SeLoadDriverPrivilege	2176	powershell.exe
Token: SeSystemProfilePrivilege	2176	powershell.exe
Token: SeSystemtimePrivilege	2176	powershell.exe
Token: SeProfSingleProcessPrivilege	2176	powershell.exe
Token: SeIncBasePriorityPrivilege	2176	powershell.exe
Token: SeCreatePagefilePrivilege	2176	powershell.exe
Token: SeBackupPrivilege	2176	powershell.exe
Token: SeRestorePrivilege	2176	powershell.exe
Token: SeShutdownPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeSystemEnvironmentPrivilege	2176	powershell.exe
Token: SeRemoteShutdownPrivilege	2176	powershell.exe
Token: SeUndockPrivilege	2176	powershell.exe
Token: SeManageVolumePrivilege	2176	powershell.exe
Token: 33	2176	powershell.exe
Token: 34	2176	powershell.exe
Token: 35	2176	powershell.exe
Token: 36	2176	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeIncreaseQuotaPrivilege	4748	powershell.exe
Token: SeSecurityPrivilege	4748	powershell.exe
Token: SeTakeOwnershipPrivilege	4748	powershell.exe
Token: SeLoadDriverPrivilege	4748	powershell.exe
Token: SeSystemProfilePrivilege	4748	powershell.exe
Token: SeSystemtimePrivilege	4748	powershell.exe
Token: SeProfSingleProcessPrivilege	4748	powershell.exe
Token: SeIncBasePriorityPrivilege	4748	powershell.exe
Token: SeCreatePagefilePrivilege	4748	powershell.exe
Token: SeBackupPrivilege	4748	powershell.exe
Token: SeRestorePrivilege	4748	powershell.exe
Token: SeShutdownPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeSystemEnvironmentPrivilege	4748	powershell.exe
Token: SeRemoteShutdownPrivilege	4748	powershell.exe
Token: SeUndockPrivilege	4748	powershell.exe
Token: SeManageVolumePrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 4768	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	90
PID 4768 wrote to memory of 4504	4768	msedgewebview2.exe	91
PID 4768 wrote to memory of 3796	4768	msedgewebview2.exe	92
PID 4768 wrote to memory of 3796	4768	msedgewebview2.exe	92
PID 4768 wrote to memory of 3796	4768	msedgewebview2.exe	92
PID 4768 wrote to memory of 3796	4768	msedgewebview2.exe	92
PID 4768 wrote to memory of 5680	4768	msedgewebview2.exe	93
PID 4768 wrote to memory of 1988	4768	msedgewebview2.exe	94
PID 4768 wrote to memory of 1988	4768	msedgewebview2.exe	94
PID 4768 wrote to memory of 1988	4768	msedgewebview2.exe	94
PID 4768 wrote to memory of 5812	4768	msedgewebview2.exe	95
PID 4768 wrote to memory of 5812	4768	msedgewebview2.exe	95
PID 4768 wrote to memory of 5812	4768	msedgewebview2.exe	95
PID 4768 wrote to memory of 5812	4768	msedgewebview2.exe	95
PID 4768 wrote to memory of 5812	4768	msedgewebview2.exe	95
PID 5368 wrote to memory of 6112	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	96
PID 6112 wrote to memory of 3640	6112	powershell.exe	98
PID 6112 wrote to memory of 5804	6112	powershell.exe	99
PID 5368 wrote to memory of 3604	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	100
PID 5368 wrote to memory of 2944	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	102
PID 5368 wrote to memory of 2176	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	105
PID 5368 wrote to memory of 4748	5368	2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	110
PID 4768 wrote to memory of 3648	4768	msedgewebview2.exe	114
PID 4768 wrote to memory of 3648	4768	msedgewebview2.exe	114
PID 4768 wrote to memory of 3648	4768	msedgewebview2.exe	114
PID 4768 wrote to memory of 1052	4768	msedgewebview2.exe	115
PID 4768 wrote to memory of 1052	4768	msedgewebview2.exe	115
PID 4768 wrote to memory of 1052	4768	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-gpu --disable-gpu-compositing --enable-features=MojoIpcz --remote-debugging-port=9222 --mojo-named-platform-channel-pipe=5368.1176.12848306018012806311 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView /prefetch:4 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffa83965fd8,0x7ffa83965fe4,0x7ffa83965ff0
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1676 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4224 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView" --webview-exe-name=2026-08-01_6bb9096ac58e395cd5ce110536ade641_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=1720,i,17555440557192306278,6945696934390235483,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:cbecc207fbe79c9ea9813ba1c54d9a3f5d8b6025
    3⤵
    PID:1052
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJAB0AGMAcABHAGwAbwBiAGEAbAAgAD0AIABuAGUAdABzAGgAIABpAG4AdAAgAHQAYwBwACAAcwBoAG8AdwAgAGcAbABvAGIAYQBsADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGUAIABpAG4AIAAkAHQAYwBwAEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlAC0AUwBpAGQAZQAgAFMAYwBhAGwAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBzACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBSAGUAYwBlAGkAdgBlACAAUwBlAGcAbQBlAG4AdAAgAEMAbwBhAGwAZQBzAGMAaQBuAGcAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAHIAcwBjACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBDAGgAaQBtAG4AZQB5ACAATwBmAGYAbABvAGEAZAAgAFMAdABhAHQAZQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAYwBoAGkAbQBuAGUAeQAnAF0AIAA9ACAAJABNAGEAdABjAGgAZQBzAFsAMQBdACAAfQAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBuAGUAIAAtAG0AYQB0AGMAaAAgACcATgBlAHQARABNAEEAIABTAHQAYQB0AGUAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AZQB0AGQAbQBhACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBOAG8AbgAgAFMAYQBjAGsAIABSAHQAdAAgAFIAZQBzAGkAbABpAGUAbgBjAHkAXABzACoAOgBcAHMAKgAoAFwAdwArACkAJwApACAAewAgACQAcgBlAHMAWwAnAG4AbwBuAHMAYQBjAGsAJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAAgACAAIAAgAGkAZgAgACgAJABsAGkAbgBlACAALQBtAGEAdABjAGgAIAAnAEUAQwBOACAAQwBhAHAAYQBiAGkAbABpAHQAeQBcAHMAKgA6AFwAcwAqACgAXAB3ACsAKQAnACkAIAB7ACAAJAByAGUAcwBbACcAZQBjAG4AJwBdACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgAH0AIAB9ACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACAAPQAgAG4AZQB0AHMAaAAgAGkAbgB0ACAAaQBwAHYANAAgAHMAaABvAHcAIABnAGwAbwBiAGEAbAA7ACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBlACAAaQBuACAAJABpAHAAdgA0AEcAbABvAGIAYQBsACkAIAB7ACAAIAAgACAAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbQBhAHQAYwBoACAAJwBEAGUAZgBhAHUAbAB0ACAASABvAHAAIABMAGkAbQBpAHQAXABzACoAOgBcAHMAKgAoAFwAZAArACkAJwApACAAewAgACQAcgBlAHMAWwAnAGgAbwBwACcAXQAgAD0AIAAkAE0AYQB0AGMAaABlAHMAWwAxAF0AIAB9ACAAfQAgACQAdABjAHAAaQBwAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAFQAYwBwAGkAcABcAFAAYQByAGEAbQBlAHQAZQByAHMAJwA7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHQAYwBwAGkAcABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAHIAZQBzAFsAJwBEAGkAcwBhAGIAbABlAFQAYQBzAGsATwBmAGYAbABvAGEAZAAnAF0AIAA9ACAAaQBmACAAKAAkAHQAYwBwAGkAcABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4AUABTAE8AYgBqAGUAYwB0AC4AUAByAG8AcABlAHIAdABpAGUAcwBbACcARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAJwBdACkAIAB7ACAAJAB0AGMAcABpAHAAUAByAG8AcABzAC4ARABpAHMAYQBiAGwAZQBUAGEAcwBrAE8AZgBmAGwAbwBhAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAHIAZQBzAFsAJwBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJAB0AGMAcABpAHAAUAByAG8AcABzACAALQBhAG4AZAAgACQAdABjAHAAaQBwAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEUAbgBhAGIAbABlAFcAYQBuAG4AYQBPAHUAdABjAG8AbQBpAG4AZwAnAF0AKQAgAHsAIAAkAHQAYwBwAGkAcABQAHIAbwBwAHMALgBFAG4AYQBiAGwAZQBXAGEAbgBuAGEATwB1AHQAYwBvAG0AaQBuAGcAIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ADsAIAAkAGEAZgBkAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAFMAZQByAHYAaQBjAGUAcwBcAEEARgBEAFwAUABhAHIAYQBtAGUAdABlAHIAcwAnADsAIAAkAGEAZgBkAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABhAGYAZABQAGEAdABoACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAkAGEAZgBkAEsAZQB5AHMAIAA9ACAAQAAoACcARABlAGYAYQB1AGwAdABSAGUAYwBlAGkAdgBlAFcAaQBuAGQAbwB3ACcALAAgACcARABlAGYAYQB1AGwAdABTAGUAbgBkAFcAaQBuAGQAbwB3ACcALAAgACcAQgB1AGYAZgBlAHIATQB1AGwAdABpAHAAbABpAGUAcgAnACwAIAAnAEIAdQBmAGYAZQByAEEAbABpAGcAbgBtAGUAbgB0ACcALAAgACcARABvAE4AbwB0AEgAbwBsAGQATgBJAEMAQgB1AGYAZgBlAHIAcwAnACwAIAAnAFQAcgBhAG4AcwBtAGkAdABXAG8AcgBrAGUAcgAnACwAIAAnAFAAcgBpAG8AcgBpAHQAeQBCAG8AbwBzAHQAJwAsACAAJwBTAG0AYQBsAGwAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAFMAaQB6AGUAJwAsACAAJwBMAGEAcgBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAEgAdQBnAGUAQgB1AGYAZgBlAHIAUwBpAHoAZQAnACwAIAAnAFMAbQBhAGwAbABCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAE0AZQBkAGkAdQBtAEIAdQBmAGYAZQByAEwAaQBzAHQARABlAHAAdABoACcALAAgACcATABhAHIAZwBCAHUAZgBmAGUAcgBMAGkAcwB0AEQAZQBwAHQAaAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAQQBkAGQAcgBlAHMAcwBTAGgAYQByAGkAbgBnACcALAAgACcARABpAHMAYQBiAGwAZQBDAGgAYQBpAG4AZQBkAFIAZQBjAGUAaQB2AGUAJwAsACAAJwBEAGkAcwBhAGIAbABlAEQAaQByAGUAYwB0AEEAYwBjAGUAcAB0AEUAeAAnACwAIAAnAEQAaQBzAGEAYgBsAGUAUgBhAHcAUwBlAGMAdQByAGkAdAB5ACcALAAgACcARAB5AG4AYQBtAGkAYwBTAGUAbgBkAEIAdQBmAGYAZQByAEQAaQBzAGEAYgBsAGUAJwAsACAAJwBGAGEAcwB0AFMAZQBuAGQARABhAHQAYQBnAHIAYQBtAFQAaAByAGUAcwBoAG8AbABkACcALAAgACcARgBhAHMAdABDAG8AcAB5AFIAZQBjAGUAaQB2AGUAVABoAHIAZQBzAGgAbwBsAGQAJwAsACAAJwBJAGcAbgBvAHIAZQBQAHUAcwBoAEIAaQB0AE8AbgBSAGUAYwBlAGkAdgBlAHMAJwAsACAAJwBJAGcAbgBvAHIAZQBPAHIAZABlAHIAbAB5AFIAZQBsAGUAYQBzAGUAJwApADsAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGEAZgBkAEsAZQB5AHMAKQAgAHsAIAAgACAAIAAgAGkAZgAgACgAJABhAGYAZABQAHIAbwBwAHMAIAAtAGEAbgBkACAAJABhAGYAZABQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJABrAF0AKQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAJABhAGYAZABQAHIAbwBwAHMALgAkAGsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJABrAF0AIAA9ACAAIgAiACAAfQAgAH0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAkAHIAZQBzACAALQBDAG8AbQBwAHIAZQBzAHMA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int tcp show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3640
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" int ipv4 show global
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5804
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwA7ACAAJAByAGUAcwAgAD0AIABAAHsAfQA7ACAAJABmAG0AUABhAHQAaAAgAD0AIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAEMAaQB0AGkAegBlAG4ARgBYAFwARgBpAHYAZQBNACcAOwAgACQAZgBtAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABmAG0AUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcAQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACcAXQAgAD0AIABpAGYAIAAoACQAZgBtAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGYAbQBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBDAEUARgBIAGEAcgBkAHcAYQByAGUAQQBjAGMAZQBsAGUAcgBhAHQAaQBvAG4AJwBdACkAIAB7ACAAJABmAG0AUAByAG8AcABzAC4AQwBFAEYASABhAHIAZAB3AGEAcgBlAEEAYwBjAGUAbABlAHIAYQB0AGkAbwBuACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAJABmAG0AUAByAGkAUABhAHQAaAAgAD0AIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAE4AVABcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEkAbQBhAGcAZQAgAEYAaQBsAGUAIABFAHgAZQBjAHUAdABpAG8AbgAgAE8AcAB0AGkAbwBuAHMAXABGAGkAdgBlAE0ALgBlAHgAZQBcAFAAZQByAGYATwBwAHQAaQBvAG4AcwAnADsAIAAkAGYAbQBQAHIAaQBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAZgBtAFAAcgBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACQAcgBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACAAPQAgAGkAZgAgACgAJABmAG0AUAByAGkAUAByAG8AcABzACAALQBhAG4AZAAgACQAZgBtAFAAcgBpAFAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAEMAcAB1AFAAcgBpAG8AcgBpAHQAeQBDAGwAYQBzAHMAJwBdACkAIAB7ACAAJABmAG0AUAByAGkAUAByAG8AcABzAC4AQwBwAHUAUAByAGkAbwByAGkAdAB5AEMAbABhAHMAcwAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0AOwAgACQAdABpAG0AZQByAFAAYQB0AGgAIAA9ACAAJwBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABTAGUAcwBzAGkAbwBuACAATQBhAG4AYQBnAGUAcgBcAGsAZQByAG4AZQBsACcAOwAgACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJAB0AGkAbQBlAHIAUABhAHQAaAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJAByAGUAcwBbACcARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACcAXQAgAD0AIABpAGYAIAAoACQAdABpAG0AZQByAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAHQAaQBtAGUAcgBQAHIAbwBwAHMALgBQAFMATwBiAGoAZQBjAHQALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBHAGwAbwBiAGEAbABUAGkAbQBlAHIAUgBlAHMAbwBsAHUAdABpAG8AbgBSAGUAcQB1AGUAcwB0AHMAJwBdACkAIAB7ACAAJAB0AGkAbQBlAHIAUAByAG8AcABzAC4ARwBsAG8AYgBhAGwAVABpAG0AZQByAFIAZQBzAG8AbAB1AHQAaQBvAG4AUgBlAHEAdQBlAHMAdABzACAAfQAgAGUAbABzAGUAIAB7ACAAIgAiACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand dAByAHkAIAB7ACAAIAAgACAAIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAfQAgAGMAYQB0AGMAaAAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEIAYQBzAGUAQgBvAGEAcgBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAEgAQQBSAEQAVwBBAFIARQBcAEQARQBTAEMAUgBJAFAAVABJAE8ATgBcAFMAeQBzAHQAZQBtAFwAQgBJAE8AUwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkALgBCAGEAcwBlAEIAbwBhAHIAZABQAHIAbwBkAHUAYwB0ACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIgBHAGUAbgBlAHIAaQBjACAATQBvAHQAaABlAHIAYgBvAGEAcgBkACIAIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABsAGkAcwB0ACAAPQAgAEAAKAApADsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJABmAGEAbABzAGUAOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBQAGgAeQBzAGkAYwBhAGwAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA7AEcAdQBpAGQAPQAkAGEAZAAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAfQAgACAAIAAgACAAIAAgACAAIAB9ACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABsAGkAcwB0AC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAJABzAHUAYwBjAGUAcwBzACAAPQAgACQAdAByAHUAZQAgAH0AIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ADsAIABpAGYAIAAoAC0AbgBvAHQAIAAkAHMAdQBjAGMAZQBzAHMAKQAgAHsAIAAgACAAIAAgAHQAcgB5ACAAewAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGEAZAAgAGkAbgAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE4AZQB0AHcAbwByAGsAQQBkAGEAcAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAFAAaAB5AHMAaQBjAGEAbABBAGQAYQBwAHQAZQByAD0AVAByAHUAZQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGEAZAAuAE4AZQB0AEMAbwBuAG4AZQBjAHQAaQBvAG4ASQBEADsARABlAHMAYwA9ACQAYQBkAC4ARABlAHMAYwByAGkAcAB0AGkAbwBuADsARwB1AGkAZAA9ACQAYQBkAC4ARwBVAEkARAB9ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGwAaQBzAHQALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsAIAAkAHMAdQBjAGMAZQBzAHMAIAA9ACAAJAB0AHIAdQBlACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAGkAZgAgACgALQBuAG8AdAAgACQAcwB1AGMAYwBlAHMAcwApACAAewAgACAAIAAgACAAdAByAHkAIAB7ACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYQBkACAAaQBuACAARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AQwBsAGEAcwBzACAAVwBpAG4AMwAyAF8ATgBlAHQAdwBvAHIAawBBAGQAYQBwAHQAZQByACAALQBGAGkAbAB0AGUAcgAgACIAUABoAHkAcwBpAGMAYQBsAEEAZABhAHAAdABlAHIAPQBUAHIAdQBlACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBzAHQAIAArAD0AIABAAHsATgBhAG0AZQA9ACQAYQBkAC4ATgBlAHQAQwBvAG4AbgBlAGMAdABpAG8AbgBJAEQAOwBEAGUAcwBjAD0AJABhAGQALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AOwBHAHUAaQBkAD0AJABhAGQALgBHAFUASQBEAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbABpAHMAdAAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAApACAAewAgACQAcwB1AGMAYwBlAHMAcwAgAD0AIAAkAHQAcgB1AGUAIAB9ACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewB9ACAAfQA7ACAAaQBmACAAKAAtAG4AbwB0ACAAJABzAHUAYwBjAGUAcwBzACkAIAB7ACAAIAAgACAAIAB0AHIAeQAgAHsAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbgBuAHMAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEMAbwBuAHQAcgBvAGwAXABOAGUAdAB3AG8AcgBrAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAQgBFADEAMAAzADEAOAB9ACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGMAIABpAG4AIAAkAGMAbwBuAG4AcwApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG4AbgBQAHIAbwBwAHMAIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIAJAAoACQAYwAuAFAAUwBQAGEAdABoACkAXABDAG8AbgBuAGUAYwB0AGkAbwBuACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAG8AbgBuAFAAcgBvAHAAcwAgAC0AYQBuAGQAIAAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQApACAAewAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAGkAcwB0ACAAKwA9ACAAQAB7AE4AYQBtAGUAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEQAZQBzAGMAPQAkAGMAbwBuAG4AUAByAG8AcABzAC4ATgBhAG0AZQA7AEcAdQBpAGQAPQAkAGMALgBQAFMAQwBoAGkAbABkAE4AYQBtAGUAfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgACAAIAAgACAAfQAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAH0AOwAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgACQAbABpAHMAdAAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABnAHUAaQBkACAAPQAgACIAewAzADMANgAwAEIAMAAyAEQALQA4ADUANgAwAC0ANABDADYANgAtAEIANgBCAEQALQA5AEEANABBADAAOAA2ADIARgBGADQANQB9ACIAOwAgACQAZABlAHMAYwAgAD0AIAAiAFIAZQBhAGwAdABlAGsAIABSAFQATAA4ADEAMwA5AEMAKwAgAEYAYQBzAHQAIABFAHQAaABlAHIAbgBlAHQAIABOAEkAQwAiADsAIAAkAHMAdQBiACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwAQwBvAG4AdAByAG8AbABcAEMAbABhAHMAcwBcAHsANABEADMANgBFADkANwAyAC0ARQAzADIANQAtADEAMQBDAEUALQBCAEYAQwAxAC0AMAA4ADAAMAAyAGIARQAxADAAMwAxADgAfQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAFAAUwBDAGgAaQBsAGQATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBeAFwAZAB7ADQAfQAkACcAIAB9ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACQAXwAuAFAAUwBQAGEAdABoACAALQBOAGEAbQBlACAAIgBOAGUAdABDAGYAZwBJAG4AcwB0AGEAbgBjAGUASQBkACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAuAE4AZQB0AEMAZgBnAEkAbgBzAHQAYQBuAGMAZQBJAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAAUABTAEMAaABpAGwAZABOAGEAbQBlADsAIAAkAHIAZQBzACAAPQAgAEAAewB9ADsAIABpAGYAIAAoACQAcwB1AGIAKQAgAHsAIAAgACAAIAAgACQAYQBwACAAPQAgACIASABLAEwATQA6AFwAUwBZAFMAVABFAE0AXABDAHUAcgByAGUAbgB0AEMAbwBuAHQAcgBvAGwAUwBlAHQAXABDAG8AbgB0AHIAbwBsAFwAQwBsAGEAcwBzAFwAewA0AEQAMwA2AEUAOQA3ADIALQBFADMAMgA1AC0AMQAxAEMARQAtAEIARgBDADEALQAwADgAMAAwADIAYgBFADEAMAAzADEAOAB9AFwAJABzAHUAYgAiADsAIAAgACAAIAAgACQAcAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAcAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAIAAgACAAIAAkAGsAZQB5AHMAIAA9ACAAQAAoACcAKgBGAGwAbwB3AEMAbwBuAHQAcgBvAGwAJwAsACAAJwAqAEkAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBUAEMAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA0ACcALAAgACcAKgBVAEQAUABDAGgAZQBjAGsAcwB1AG0ATwBmAGYAbABvAGEAZABJAFAAdgA2ACcALAAgACcAKgBMAHMAbwBWADIASQBQAHYANAAnACwAIAAnACoATABzAG8AVgAyAEkAUAB2ADYAJwAsACAAJwAqAFAAcgBpAG8AcgBpAHQAeQBWAEwAQQBOAFQAYQBnACcALAAgACcAKgBJAG4AdABlAHIAcgB1AHAAdABNAG8AZABlAHIAYQB0AGkAbwBuACcALAAgACcASQBUAFIAJwAsACAAJwAqAFAAYQBjAGsAZQB0AEQAaQByAGUAYwB0ACcALAAgACcAKgBSAGUAYwBlAGkAdgBlAEIAdQBmAGYAZQByAHMAJwAsACAAJwAqAFQAcgBhAG4AcwBtAGkAdABCAHUAZgBmAGUAcgBzACcALAAgACcAVAB4AEkAbgB0AEQAZQBsAGEAeQAnACwAIAAnAEMAbwBhAGwAZQBzAGMAZQBCAHUAZgBmAGUAcgBTAGkAegBlACcALAAgACcAKgBQAE0AQQBSAFAATwBmAGYAbABvAGEAZAAnACwAIAAnACoAUABNAE4AUwBPAGYAZgBsAG8AYQBkACcAKQA7ACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGsAIABpAG4AIAAkAGsAZQB5AHMAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAHAAcwAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAGsAXQApACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAkAHAAcgBvAHAAcwAuACQAawAgAH0AIABlAGwAcwBlACAAewAgACQAcgBlAHMAWwAkAGsAXQAgAD0AIAAiACIAIAB9ACAAIAAgACAAIAB9ACAAIAAgACAAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0ASQBuAHQAZQByAGYAYQBjAGUARABlAHMAYwByAGkAcAB0AGkAbwBuACAAJABkAGUAcwBjACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkALgBQAG4AcABJAEQAOwAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwAG4AcABJAGQAKQAgAHsAIAAkAHAAbgBwAEkAZAAgAD0AIAAoAEcAZQB0AC0ATgBlAHQAQQBkAGEAcAB0AGUAcgAgAC0AUABoAHkAcwBpAGMAYQBsACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEkAbgB0AGUAcgBmAGEAYwBlAEcAdQBpAGQAIAAtAGUAcQAgACQAZwB1AGkAZAAgAH0AKQAuAFAAbgBwAEkARAA7ACAAfQAgACAAIAAgACAAaQBmACAAKAAkAHAAbgBwAEkAZAApACAAewAgACAAIAAgACAAIAAgACAAIAAkAG0AcwBpAFAAYQB0AGgAIAA9ACAAIgBIAEsATABNADoAXABTAFkAUwBUAEUATQBcAEMAdQByAHIAZQBuAHQAQwBvAG4AdAByAG8AbABTAGUAdABcAEUAbgB1AG0AXAAkAHAAbgBwAEkAZABcAEQAZQB2AGkAYwBlACAAUABhAHIAYQBtAGUAdABlAHIAcwBcAEkAbgB0AGUAcgByAHUAcAB0ACAATQBhAG4AYQBnAGUAbQBlAG4AdABcAE0AZQBzAHMAYQBnAGUAUwBpAGcAbgBhAGwAZQBkAEkAbgB0AGUAcgByAHUAcAB0AFAAcgBvAHAAZQByAHQAaQBlAHMAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAbQBzAGkAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAG0AcwBpAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAbQBzAGkAUAByAG8AcABzACkAIAB7ACAAJAByAGUAcwBbACcATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAJwBdACAAPQAgACQAbQBzAGkAUAByAG8AcABzAC4ATQBTAEkAUwB1AHAAcABvAHIAdABlAGQAIAB9ACAAZQBsAHMAZQAgAHsAIAAkAHIAZQBzAFsAJwBNAFMASQBTAHUAcABwAG8AcgB0AGUAZAAnAF0AIAA9ACAAIgAiACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUABhAHQAaAAgAD0AIAAiAEgASwBMAE0AOgBcAFMAWQBTAFQARQBNAFwAQwB1AHIAcgBlAG4AdABDAG8AbgB0AHIAbwBsAFMAZQB0AFwARQBuAHUAbQBcACQAcABuAHAASQBkAFwARABlAHYAaQBjAGUAIABQAGEAcgBhAG0AZQB0AGUAcgBzAFwASQBuAHQAZQByAHIAdQBwAHQAIABNAGEAbgBhAGcAZQBtAGUAbgB0AFwAQQBmAGYAaQBuAGkAdAB5ACAAUABvAGwAaQBjAHkAIgA7ACAAIAAgACAAIAAgACAAIAAgACQAYQBmAGYAUAByAG8AcABzACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAGEAZgBmAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYQBmAGYAUAByAG8AcABzACkAIAB7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUAByAGkAbwByAGkAdAB5ACcAXQAgAD0AIAAkAGEAZgBmAFAAcgBvAHAAcwAuAEQAZQB2AGkAYwBlAFAAcgBpAG8AcgBpAHQAeQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACQAYQBmAGYAUAByAG8AcABzAC4ARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAOwAgACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBEAGUAdgBpAGMAZQBQAHIAaQBvAHIAaQB0AHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcARABlAHYAaQBjAGUAUABvAGwAaQBjAHkAJwBdACAAPQAgACIAIgA7ACAAIAAgACAAIAAgACAAIAAgAH0AIAAgACAAIAAgAH0AIAAgACAAIAAgACQAbgBlAHQASQBwACAAPQAgAEcAZQB0AC0ATgBlAHQASQBQAEkAbgB0AGUAcgBmAGEAYwBlACAALQBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAkAGQAZQBzAGMAIAAtAEEAZABkAHIAZQBzAHMARgBhAG0AaQBsAHkAIABJAFAAdgA0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIAAgACAAIAAgAGkAZgAgACgAJABuAGUAdABJAHAAKQAgAHsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQB0AHUAJwBdACAAPQAgACQAbgBlAHQASQBwAC4ATgBsAE0AdAB1ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAYQBkAHYAUgBvAHUAdABlACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGUARABlAGYAYQB1AGwAdABSAG8AdQB0AGUAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBhAGQAdgBlAHIAdABpAHMAaQBuAGcAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAGQAdgBlAHIAdABpAHMAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AQQBkAHYAZQByAHQAaQBzAGkAbgBnACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAbQBlAHQAcgBpAGMAJwBdACAAPQAgAGkAZgAgACgAJABuAGUAdABJAHAALgBBAHUAdABvAG0AYQB0AGkAYwBNAGUAdAByAGkAYwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAG0AcwBzACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AQwBsAGEAbQBwAE0AcwBzACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsAIAAnAGUAbgBhAGIAbABlAGQAJwAgAH0AIABlAGwAcwBlACAAewAgACcAZABpAHMAYQBiAGwAZQBkACcAIAB9ADsAIAAgACAAIAAgACAAIAAgACAAJAByAGUAcwBbACcAZgBvAHIAdwBhAHIAZABpAG4AZwAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEYAbwByAHcAYQByAGQAaQBuAGcAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4ARgBvAHIAdwBhAHIAZABpAG4AZwAgAC0AZQBxACAAJAB0AHIAdQBlACkAIAB7ACAAJwBlAG4AYQBiAGwAZQBkACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAGQAaQBzAGEAYgBsAGUAZAAnACAAfQA7ACAAIAAgACAAIAAgACAAIAAgACQAcgBlAHMAWwAnAGkAZwBuAG8AcgBlAFIAbwB1AHQAZQAnAF0AIAA9ACAAaQBmACAAKAAkAG4AZQB0AEkAcAAuAEkAZwBuAG8AcgBlAEQAZQBmAGEAdQBsAHQAUgBvAHUAdABlAHMAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAG8AdQB0AGUAcgBEAGkAcwBjACcAXQAgAD0AIABpAGYAIAAoACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgADEAIAAtAG8AcgAgACQAbgBlAHQASQBwAC4AUgBvAHUAdABlAHIARABpAHMAYwBvAHYAZQByAHkAIAAtAGUAcQAgACQAdAByAHUAZQApACAAewAgACcAZQBuAGEAYgBsAGUAZAAnACAAfQAgAGUAbABzAGUAIAB7ACAAJwBkAGkAcwBhAGIAbABlAGQAJwAgAH0AOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwBiAGEAcwBlAFIAZQBhAGMAaAAnAF0AIAA9ACAAJABuAGUAdABJAHAALgBCAGEAcwBlAFIAZQBhAGMAaABhAGIAbABlAFQAaQBtAGUAOwAgACAAIAAgACAAIAAgACAAIAAkAHIAZQBzAFsAJwByAGUAdAByAGEAbgBzACcAXQAgAD0AIAAkAG4AZQB0AEkAcAAuAFIAZQB0AHIAYQBuAHMAbQBpAHQAVABpAG0AZQA7ACAAIAAgACAAIAB9ACAAfQA7ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAAJAByAGUAcwAgAC0AQwBvAG0AcAByAGUAcwBzAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

T1556

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2ad21a8478c318810663631ac97d10409272c849cd9d3a56fae76815c3f77386
MD5 7f8885acc1ada31457e8828edd40fd1d
SHA1 e88e548c5010a7a84ee8528c819ce632c875072b
SHA512 c09f726b47eeeea2cb3e2f9aa91ca873c8be2e0bb41674f7f564a5c41ed65d9ab19058f32701a5bf267f0b37a36cf036d1d6719b029897394d6cd85b0d86af70
TLSH
T1F731CE37B7CC4695C85E443600CD9C1032F586DB80DEDF9BB741D445792F5C4DE64950
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 52a10b937f7b4c0b5d40a4ba37838e44d905441a2a59fe49a63c5d0c9fe8c12f
MD5 04f178d99a5c7ae33a1fbeeb7b3c2d48
SHA1 0d3fd103cf6d06fca7372a4707a18f980aeeb142
SHA512 372f8b4b711a955717c65323c389c1ac982c046e473b7e7a4261df533bd01a5810b53e5dc9cff400fcc5aeb05a4d0c69f99e7e9bde9cd0121078232cf5a9e932
TLSH
T17931CB37F7CC8695C85E443600CDAC1032F586DB80EEDE9BBB81D444796F6C8DE68950
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1ab1e3ba4beeec052bbeb892c03fc5e512bda2df568c45e667e6c557a6ee1fe2
MD5 0fe0fad61587256ee604d1da0b54d757
SHA1 3df37551d79f6bf47ac80cf0a0e0351b5799209b
SHA512 dcba0481db575e3be85cb1cb3557f6b7656aea824c0fd1915655a8cdcf10806e713f2a87d35bffc8682499025e74da21dbfa724b9df77b56373d8ed3077d51a3
TLSH
T12C219833F3DC8214CC99403A10DDAC1036B6C7DB40DECF9B6B85E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c96bb802ee2a518d78e24a775b53686178b88e8ebf2cd9fd37a02cab3338db86
MD5 8c4b041823ecfe9d00491da6ea6e304c
SHA1 56d2e12227a79230d27b138ba43d15e46d9de725
SHA512 67d9ae3f4a59dd3e1aa0a4e81dc5afc3b44c1cacb83b3204041d9495a871d3a6f04eaeceb12ef17b36097a05de77342af7a0590704ce1678da56fcbfaacbfefa
TLSH
T1EE31BD6BB3DC8656C89A403610CDA95032B987DB819F8E977A80D245B43F389DE64394
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 03c4bf1e74527740939f4c172af9ecf4bda674cd3e532f1f182add0ab1e5b345
MD5 c29af3671743f94e5b75682c2e122e4a
SHA1 5aeca6c1c3e0c7d47e5d10f2dbdc216ebf81ea12
SHA512 9a9579c142597f73c98e4fcad069f092d0d34e1f80c95ea611ea5fcfd63471d83685d15d788ff8c0e953ef8a45927cbdb5df5ed3878c85bca9b9ecb1848c8303
TLSH
T1B3D0121336010138C82025732142614A0400C92B41464540643C961F1E4C4501F4A441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90040682597486446d310bfb1595b93806e90f9efe88469ffced3786d4e16501
MD5 68f1e58e5766fede266bbf756880d649
SHA1 85ca50057449bd6c2c221b07f0128ea50e5ff629
SHA512 7dafc5c7673e1c59cfcb0c93ca6061b3351dc62ced2f819da2bc4ef614cb278ede5cffb59e72fa9a18df8b66294ab4b7ee074d930024535d3321b4c695bf3504
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 a42e2cc12295e7601ba2f4678d9a2d68f59052ece9af3eec89b8b3f857d9faed
MD5 8998ed54d8f9484e25c509b5d38d78c6
SHA1 df00337b510492a4f1f8d11e790ca81a0de4b386
SHA512 2bcd0261438a7f5895079e56933343daa0dc8048e59caa48d31bdbed3488c8930fae29299557dc91d2c585ab68cf0a5c15ffa6b4b095ad84be4496a9cdb5ce44
TLSH
T17F3199BAC7D8477E885152F45B366927CD2D496A82383C2289E9BF9F73E04B1D20018F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59ee2f.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\Network Persistent State~RFe59ee2f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 bb0ad9102f4443f718aeae6110db489fd5602dcec4e455c1be214e34e92b83ef
MD5 b74dd03c3583743ecd116238e44356ae
SHA1 e2d592e93d44f9c47bc635c5fe0bdf184ff0b346
SHA512 7adbedeafb09f08ba7cad44c4b3d924ff38eee46754ce643d02beca6824e8ca034701224a7bb4954d070efb53f6c7d753464bce879c8957803e75ff1bbcd1d59
TLSH
T11AE020D2407EA976103C09575D407955BF35F835515368E4D7A5CF6CF0440FA516702A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5959ce.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Network\TransportSecurity~RFe5959ce.TMP
Size 356B
SHA256 9f9c4a24f63b7b283f132ac32ad050f5e83f9e2b1ae0901f10b017f4c95bea57
MD5 2388f090cd88c382b4ae9f66d124ae65
SHA1 cd215bf53cbcf71f5056be125447f36cee64b7f2
SHA512 703316ae1b7aea33a2d2d19ecda01d4531c501e3b85f7e7e4b1e5b5272d1899f2b3d345136c25683434f0a820e4975288b78a66d4394f57cf73addc77e82dace
TLSH
T16DE0C092403EB4A6103C0D278D407955BF35F834119328E4C7D1CB2CF0400F6121B42A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 f274cf3f3987b97c2f6393ba10df86059257d4ce5c32a1557ed78381f9e90bf7
MD5 16a2bc756b4a10a4984cf08abfe6f6c2
SHA1 ec20062ff9508743e7540eb4ddf3a65d409b0aea
SHA512 c0b49ef7376b27b380721fd4568a6e1445ba1708ff2d667880f41aa7d8b593cc592b539d0b5b98c31923a90de9d621706dbbd2822efb897b45c8f5618e2b550e
SSDEEP 96:stu/dzoGOfSb9okqOo5h16Zd9s7/x+6MhmuecmA3YccsekK+gL+28XM1C7K:st2pSAos9sV+FiA3Yccs4V+G6K
TLSH
T10BD1B6025E28A97B4CCAF519BA65FA17E3F5503264D11E98EBFCC62C04DB5DE6207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences
Size 6KB
SHA256 9f627e5a50ea1f1cbe5ca39a6964805ea8fadab3b2ee6da3870ab4c0cac805ba
MD5 0d42a182aade19983e8e4444c98f2c32
SHA1 7c38e300df86931689bd91d95b31c253bcc73b4a
SHA512 6bc41b8c5a3620f58256a7c54020203b3f9a76bf7bb7124fe58fcbac57bd8944daf5bc9434bcc1873e0f6f9b9bf20a13c8f807448719548c037829d7c0d3fb44
SSDEEP 96:stu/dzoGVGfSb9okqOo5h16Zd9s7/x+6MhmuecmA3YccsekK+gJ+28XM1C7K:st2pEAos9sV+FiA3Yccs4b+G6K
TLSH
T11ED1B5025A28697B4CCBF519BA65FB13D3F5603265D11E98EBFCCA2C04DB6DE6207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe595579.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Preferences~RFe595579.TMP
Size 6KB
SHA256 d2d7f9120cc0cfdfeb1260cbfc28ff5ad2f49b7b44056f3a295395f445ccdb40
MD5 776279830fe8033c047eb673f4a96f4a
SHA1 1c1a9ad008e51249c4ad6aa2ad31ff25f3bd8a06
SHA512 76ed92dbe5731d673e7c65a46c5e7323e9fffc622693a7858474b27b6f224ee92c44b2546d8130b82b719ce63b9168f95ef52f75712e88d5f96995f990b321f7
SSDEEP 96:ru/dzoGOfSb9okzdo616Zd9s7/x+6MhmuecmA3YccsekK+g4+28XM1C7K:r2pSKoP9sV+FiA3Yccs4q+G6K
TLSH
T11FD1B6025A28697B0CCAF519FA65FA16D3F5503264D51EA8EBFCC62C04DB5DD220BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 2KB
SHA256 bb511554952422720fd1902e8352812f7e07c4f85a463782e099ad7062504de3
MD5 941feacf02dc07b13a10ac7e6c3930a9
SHA1 9f2a1adcf908f6402f321ae5cade622a25cc4026
SHA512 24e4132b95740f7c45ed1f10ed6b35ef87933f56c8e9fa50434ad8c77e6dc12368c658b312918c8114f2e831fd8f996d2d90523cca31b140fa82c15e2d4531b2
TLSH
T18F51743368249B3399E35719798BBE238F799062EA632F6096EC5B1C01C369C1346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 6405d366314042aae332b643eecc3c1204411f9b15ec90dafd05c86a89712ffb
MD5 14fcb4678a638328f458f255dbbc3e34
SHA1 19c0c55e7769f002f86cebfb182cdda666ddb193
SHA512 fabdd2b30baf00a14afc32f6504f3a37c384cf1309f48736050ba32f0679f299920c718079f3e31395ef954682431fba45ed70a6b9c66de20e37dbec02502d2e
TLSH
T1436183376974AA374DE39A15B9C67B16ABB55023E9A23FA4D6EC1F0C01D339C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 3KB
SHA256 b34c601800712f94bba8acbfcad558f6c7b31542442319ad20990813c7e5641f
MD5 7049fff6940fd4661c29fc185109dca7
SHA1 701cbd6fabd9669786ca0bc6dbae30c5ed24bbe4
SHA512 66cd99188e6ba574cb21563284eac733a974c443e52345c52341fda51adcf83d523d5658a188c301a05a35149c7b391a5c8c051ee625628ba413242de20e0225
TLSH
T15F7174266574AA375DF2DA05BD867F12A7B55023E5A23FA9D6EC4F0C01D72CC0346C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State
Size 15KB
SHA256 e3f3c52b8cff16ee96778cbade6e0fb895997c248ee516841a34f3e1a5bcc34b
MD5 fe7ec4cc8cbfd62e07b06be1902bd4fe
SHA1 0ee6ccec4d98935bc785eeb255d07f4c7da13dd9
SHA512 ef70f391b0d839fc60c797210029cd8cdbe1f7494ff7992897f387a460c1edd3f348e2eefea22996a0dc0ea016256e755266cd8d2c4511c824510a11d2ccd622
SSDEEP 384:o+aQikB+z/xvxjg/qhEpNBS7oEWvM3eb87B9z0:n/UxvxjgC+DzvwLBF0
TLSH
T105728E2B55787E2395F3F60579995B9BCBF898B394C27AB44ABD9F0D02C33D80346812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d7fc.TMP

Path C:\Users\Admin\AppData\Local\Temp\AspasSettings_Data\EBWebView\Local State~RFe58d7fc.TMP
Size 1KB
SHA256 593a13f838428f4aecc80320a2ec6e4f6a409a1207a11c44cbbd73063446883e
MD5 3f9bb0b695efe733a4dbacb3e7643a5c
SHA1 2ceb435f6efdb647f03dd0404c8759062746d4a2
SHA512 c47c55a9f6e253778638ef32dfa16884b7490e6b532f4f70588f135c92cd060a9a77175bf51ca4e91bbf1aacf78b76faccf2296d504f19bb60eb59bbc2ae22fc
TLSH
T1FD216273E4788F33AC9223163243FA6B4F715027D2720E40A2EDCB1C02D369C965AD32
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gxuvafox.ed0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxuvafox.ed0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 293B
SHA256 b2d5a77838949f23d1589e117c0da75cbefa328aa3de64a2918513d2c787a88a
MD5 61ab67c340b54781439c04df33dd98fb
SHA1 c0cd83af6da185a5e258a9ac3925ee08d40001a8
SHA512 d1827d8acd684696667605ab0e0901c5fbc9b2a2db79c118ef5dacc6d70bbdde4dfc0b6f69f24d5e8647dba8a5f258c4a93b2f6f6f2bb9314af27bb0f42baedf
TLSH
T1BDE07D325AA003A907E780D7C68B13F20C7A100432274E5473E847D81950056833C2B8
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 943B
SHA256 15b5d5e8fc988c695ee07549696b42d9d2faaf555d37566bb7919e3a889d7304
MD5 d65a5bb391a56db4c833da0bfa789ad2
SHA1 8d6bbbc117ef6c4068bd9a0d70681913d7aac68d
SHA512 b1f766dc7391b36593e059c5585fa2a5f08fb382268538ee2f558dca69392ded70d38531fb707eb805d7108bc5da866ed73e034b5d1956b4c77cb8aed82220c6
TLSH
T19311E12201B1063547DB41CB628792D795282C9572475DFF639CAFEC3983288C3FE56D
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_app_log.txt

Path C:\Users\Admin\AppData\Local\Temp\aspas_app_log.txt
Size 1KB
SHA256 1764b227594e6fc69671530e4c2995deee12366a852ddaf3a4b663936ced1007
MD5 2d36ad77fa34e53d4d78a5bd8279c429
SHA1 718398bf0556fc861674b4a7140c23698a1355fc
SHA512 0573e24d94a707ca7cd47fd85a81e47c6818cc46606a9a0144bb86ddf1546e298a53dbfa6f31c402fd25411395001c3a872d3ccae5bd2bca0ff3526d1ce0e95e
TLSH
T15A3145130075427602DB10972182999752B82CC5338E1BEEEB987FD8B48368E83BED9D
MD5 SHA1 SHA512 TLSH

Submit Download

aspas_ui.html

Path C:\Users\Admin\AppData\Local\Temp\aspas_ui.html
Size 2.4MB
SHA256 081398954d647ba2ded88bd708eb48e9c54344620d116fcc4ee1500d0d5d3e41
MD5 a6650dd1dd4414f0fd9dab7a4fe27539
SHA1 f0e81c12029cd2adc4116300d4334e5aea4c7300
SHA512 dd330526b147d12951dfaa40854b29d38aeeba287f3610c7b963f9064e01fd6d4afd1f457718f9698cf04f8d907a39b05297d57e1ef38d61f407c0e15881338b
SSDEEP 24576:FSWZc0KM5eBbkgIbtpmBWapavA9OSE89nBr+dpTcXg7oWZc0KM5eBbkgIbtpmBWM:FSMKM5i0hYBKWsRaMKM5i0hYBKWsRs
TLSH
T1A0C5122015F31976006B80ADAF979B0B3F699603850AC1FC3AEC47D94FCBD56CA2796D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2176-225-0x000001CACDA90000-0x000001CACDAAE000-memory.dmp

Download

memory/2944-212-0x000001DB5CF50000-0x000001DB5CF74000-memory.dmp

Download

memory/2944-211-0x000001DB5CF50000-0x000001DB5CF7A000-memory.dmp

Download

memory/2944-210-0x000001DB5CCA0000-0x000001DB5CCAA000-memory.dmp

Download

memory/2944-209-0x000001DB5CAE0000-0x000001DB5CB92000-memory.dmp

Download

memory/2944-208-0x000001DB5C890000-0x000001DB5C8AE000-memory.dmp

Download

memory/3648-317-0x00007FFAA6180000-0x00007FFAA6181000-memory.dmp

Download

memory/3648-318-0x00007FFAA6190000-0x00007FFAA6191000-memory.dmp

Download

memory/3796-279-0x0000023471690000-0x0000023471739000-memory.dmp

Download

memory/3796-22-0x00007FFAA5220000-0x00007FFAA5221000-memory.dmp

Download

memory/3796-157-0x0000023471690000-0x0000023471739000-memory.dmp

Download

memory/5812-99-0x00007FFAA5220000-0x00007FFAA5221000-memory.dmp

Download

memory/5812-280-0x0000025EB2E40000-0x0000025EB2EE9000-memory.dmp

Download

memory/5812-315-0x0000025EB2E40000-0x0000025EB2EE9000-memory.dmp

Download

memory/5812-170-0x0000025EB2E40000-0x0000025EB2EE9000-memory.dmp

Download

memory/5812-247-0x0000025EB2E40000-0x0000025EB2EE9000-memory.dmp

Download

memory/6112-192-0x0000025C730B0000-0x0000025C73272000-memory.dmp

Download

memory/6112-193-0x0000025C737B0000-0x0000025C73CD8000-memory.dmp

Download

memory/6112-187-0x0000025C72AC0000-0x0000025C72AE2000-memory.dmp

Download