1be14cc1883eab57b838b6ee895c92f1f8cbe951bb9db05c4a4b3cd296c70704

Analysis

user interaction
yes
max time kernel
47s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsUpdate.exe
Size 18.2MB
Sample260620-k8jaysft3x
SHA256 1be14cc1883eab57b838b6ee895c92f1f8cbe951bb9db05c4a4b3cd296c70704
MD5 1c4916f3209e2c82c1831917b1837420
SHA1 bc00cb9c334a3426c7c9d06427da2d3424960de4
SHA512 953cd3e2515ddda2e484e0d561d9b451e549ac71d81e820a26fc10c67295bd4a262c0d99312ea10a6fbfc1de7118585b3d528774bb5407c208c9941ebc82104b
SSDEEP 393216:5Tr2DS8BG+u6fb+SJ8aqq1CPwDvt3uFhCas4eBM609Bu:5T6DS8BLgBu
TLSH
T162177C5176908466F8B6F279C5170606E370ECB16720C7CB319DB2691F37BE12EBA6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 7 IoCs

pid	Process
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe
1396	WindowsUpdate.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 16 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3728	taskkill.exe
3412	taskkill.exe
2508	taskkill.exe
3544	taskkill.exe
1972	taskkill.exe
4964	taskkill.exe
5176	taskkill.exe
4884	taskkill.exe
4596	taskkill.exe
5480	taskkill.exe
2036	taskkill.exe
4000	taskkill.exe
4496	taskkill.exe
3496	taskkill.exe
2092	taskkill.exe
1708	taskkill.exe
4056	taskkill.exe
472	taskkill.exe
2104	taskkill.exe
1724	taskkill.exe
4476	taskkill.exe
6072	taskkill.exe
5324	taskkill.exe
5924	taskkill.exe
432	taskkill.exe
1556	taskkill.exe
4248	taskkill.exe
2368	taskkill.exe
4080	taskkill.exe
1916	taskkill.exe
5272	taskkill.exe
760	taskkill.exe
5884	taskkill.exe
1772	taskkill.exe
5504	taskkill.exe
1676	taskkill.exe
4240	taskkill.exe
5028	taskkill.exe
2268	taskkill.exe
2428	taskkill.exe
5940	taskkill.exe
5036	taskkill.exe
6044	taskkill.exe
3672	taskkill.exe
3312	taskkill.exe
5536	taskkill.exe
248	taskkill.exe
1292	taskkill.exe
5952	taskkill.exe
2368	taskkill.exe
900	taskkill.exe
1376	taskkill.exe
1696	taskkill.exe
3092	taskkill.exe
2720	taskkill.exe
5144	taskkill.exe
3332	taskkill.exe
3864	taskkill.exe
2860	taskkill.exe
6068	taskkill.exe
1916	taskkill.exe
988	taskkill.exe
1448	taskkill.exe
4088	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
6008	Process not Found
4484	Process not Found
792	Process not Found
3508	Process not Found
4724	Process not Found
4000	Process not Found
652	Process not Found
4752	Process not Found
5792	Process not Found
4732	Process not Found
2056	Process not Found
3432	Process not Found
3520	Process not Found
3440	Process not Found
3388	Process not Found
3436	Process not Found
6116	Process not Found
3256	Process not Found
4144	Process not Found
1292	Process not Found
3528	Process not Found
3348	Process not Found
408	Process not Found
4544	Process not Found
5912	Process not Found
5028	Process not Found
1484	Process not Found
1916	Process not Found
3180	Process not Found
2424	Process not Found
1768	Process not Found
4232	Process not Found
1976	Process not Found
1100	Process not Found
3600	Process not Found
3576	Process not Found
4920	Process not Found
4860	Process not Found
5024	Process not Found
4676	Process not Found
1924	Process not Found
3500	Process not Found
5080	Process not Found
5620	Process not Found
5132	Process not Found
2092	Process not Found
3164	Process not Found
5408	Process not Found
4416	Process not Found
4536	Process not Found
5780	Process not Found
3260	Process not Found
5656	Process not Found
1644	Process not Found
1316	Process not Found
560	Process not Found
4472	Process not Found
2540	Process not Found
5176	Process not Found
4012	Process not Found
3992	Process not Found
3176	Process not Found
2560	Process not Found
4916	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeCreateGlobalPrivilege	5604	dwm.exe
Token: SeChangeNotifyPrivilege	5604	dwm.exe
Token: 33	5604	dwm.exe
Token: SeIncBasePriorityPrivilege	5604	dwm.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	5240	taskkill.exe
Token: SeDebugPrivilege	5784	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeCreateGlobalPrivilege	5584	dwm.exe
Token: SeChangeNotifyPrivilege	5584	dwm.exe
Token: 33	5584	dwm.exe
Token: SeIncBasePriorityPrivilege	5584	dwm.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	6072	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	5940	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	3412	taskkill.exe
Token: SeDebugPrivilege	5324	taskkill.exe
Token: SeCreateGlobalPrivilege	5340	dwm.exe
Token: SeChangeNotifyPrivilege	5340	dwm.exe
Token: 33	5340	dwm.exe
Token: SeIncBasePriorityPrivilege	5340	dwm.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeDebugPrivilege	4496	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	5176	taskkill.exe
Token: SeCreateGlobalPrivilege	5612	dwm.exe
Token: SeChangeNotifyPrivilege	5612	dwm.exe
Token: 33	5612	dwm.exe
Token: SeIncBasePriorityPrivilege	5612	dwm.exe
Token: SeDebugPrivilege	5924	taskkill.exe
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	3672	taskkill.exe
Token: SeDebugPrivilege	472	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	4596	taskkill.exe
Token: SeDebugPrivilege	3312	taskkill.exe
Token: SeDebugPrivilege	5504	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeCreateGlobalPrivilege	2096	dwm.exe
Token: SeChangeNotifyPrivilege	2096	dwm.exe
Token: 33	2096	dwm.exe
Token: SeIncBasePriorityPrivilege	2096	dwm.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	988	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5500	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1396	2416	WindowsUpdate.exe	80
PID 1396 wrote to memory of 5148	1396	WindowsUpdate.exe	81
PID 5148 wrote to memory of 4012	5148	cmd.exe	83
PID 1396 wrote to memory of 1820	1396	WindowsUpdate.exe	85
PID 1820 wrote to memory of 4248	1820	cmd.exe	87
PID 1396 wrote to memory of 1048	1396	WindowsUpdate.exe	88
PID 1048 wrote to memory of 5600	1048	cmd.exe	91
PID 1396 wrote to memory of 4092	1396	WindowsUpdate.exe	92
PID 4092 wrote to memory of 5240	4092	cmd.exe	94
PID 1396 wrote to memory of 2584	1396	WindowsUpdate.exe	95
PID 2584 wrote to memory of 5784	2584	cmd.exe	97
PID 1396 wrote to memory of 5804	1396	WindowsUpdate.exe	98
PID 5804 wrote to memory of 2036	5804	cmd.exe	100
PID 1396 wrote to memory of 5484	1396	WindowsUpdate.exe	101
PID 5484 wrote to memory of 3864	5484	cmd.exe	103
PID 1396 wrote to memory of 3144	1396	WindowsUpdate.exe	104
PID 3144 wrote to memory of 4772	3144	cmd.exe	106
PID 1396 wrote to memory of 5928	1396	WindowsUpdate.exe	107
PID 5928 wrote to memory of 3728	5928	cmd.exe	109
PID 1396 wrote to memory of 4520	1396	WindowsUpdate.exe	110
PID 4520 wrote to memory of 2860	4520	cmd.exe	112
PID 1396 wrote to memory of 1876	1396	WindowsUpdate.exe	113
PID 1876 wrote to memory of 4056	1876	cmd.exe	115
PID 1396 wrote to memory of 848	1396	WindowsUpdate.exe	116
PID 848 wrote to memory of 2268	848	cmd.exe	119
PID 1396 wrote to memory of 1632	1396	WindowsUpdate.exe	120
PID 1632 wrote to memory of 6072	1632	cmd.exe	122
PID 1396 wrote to memory of 2164	1396	WindowsUpdate.exe	123
PID 2164 wrote to memory of 2428	2164	cmd.exe	125
PID 1396 wrote to memory of 4048	1396	WindowsUpdate.exe	126
PID 4048 wrote to memory of 1972	4048	cmd.exe	128
PID 1396 wrote to memory of 5268	1396	WindowsUpdate.exe	129
PID 5268 wrote to memory of 3092	5268	cmd.exe	131
PID 1396 wrote to memory of 2500	1396	WindowsUpdate.exe	132
PID 2500 wrote to memory of 5940	2500	cmd.exe	134
PID 1396 wrote to memory of 5356	1396	WindowsUpdate.exe	135
PID 5356 wrote to memory of 6068	5356	cmd.exe	137
PID 1396 wrote to memory of 5412	1396	WindowsUpdate.exe	138
PID 5412 wrote to memory of 3412	5412	cmd.exe	140
PID 1396 wrote to memory of 236	1396	WindowsUpdate.exe	141
PID 236 wrote to memory of 5324	236	cmd.exe	143
PID 1396 wrote to memory of 1844	1396	WindowsUpdate.exe	144
PID 1844 wrote to memory of 2092	1844	cmd.exe	147
PID 1396 wrote to memory of 1492	1396	WindowsUpdate.exe	148
PID 1492 wrote to memory of 2368	1492	cmd.exe	150
PID 1396 wrote to memory of 2804	1396	WindowsUpdate.exe	151
PID 2804 wrote to memory of 4964	2804	cmd.exe	153
PID 1396 wrote to memory of 1020	1396	WindowsUpdate.exe	154
PID 1020 wrote to memory of 1708	1020	cmd.exe	156
PID 1396 wrote to memory of 5704	1396	WindowsUpdate.exe	157
PID 5704 wrote to memory of 4000	5704	cmd.exe	159
PID 1396 wrote to memory of 4684	1396	WindowsUpdate.exe	160
PID 4684 wrote to memory of 4496	4684	cmd.exe	162
PID 1396 wrote to memory of 4980	1396	WindowsUpdate.exe	163
PID 4980 wrote to memory of 1916	4980	cmd.exe	165
PID 1396 wrote to memory of 2028	1396	WindowsUpdate.exe	166
PID 2028 wrote to memory of 1772	2028	cmd.exe	168
PID 1396 wrote to memory of 2480	1396	WindowsUpdate.exe	169
PID 2480 wrote to memory of 5176	2480	cmd.exe	171
PID 1396 wrote to memory of 896	1396	WindowsUpdate.exe	172
PID 896 wrote to memory of 5924	896	cmd.exe	175
PID 1396 wrote to memory of 2152	1396	WindowsUpdate.exe	176
PID 2152 wrote to memory of 900	2152	cmd.exe	178
PID 1396 wrote to memory of 1360	1396	WindowsUpdate.exe	179

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    PID:1360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    PID:4216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    PID:3624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    PID:4772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    PID:3728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    PID:4056
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    PID:1528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    PID:3688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    PID:3244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    PID:2320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    PID:1028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    PID:3004
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    PID:5124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:5660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    PID:2596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    PID:572
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    PID:5632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    PID:3232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    PID:3368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    PID:3224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    PID:3400
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    PID:5452
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    PID:5012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    PID:3780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    PID:2432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    PID:5376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      Kills process with taskkill
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    PID:900
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      Kills process with taskkill
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    PID:2960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    PID:748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    PID:992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:2228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    PID:3848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    PID:3708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    PID:596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SearchApp.exe"
    3⤵
    PID:5348
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SearchApp.exe
      4⤵
      PID:3788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im StartMenuExperienceHost.exe"
    3⤵
    PID:4668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im StartMenuExperienceHost.exe
      4⤵
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im TextInputHost.exe"
    3⤵
    PID:4592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im TextInputHost.exe
      4⤵
      Kills process with taskkill
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im SystemSettings.exe"
    3⤵
    PID:4212
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im SystemSettings.exe
      4⤵
      Kills process with taskkill
      PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ApplicationFrameHost.exe"
    3⤵
    PID:800
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ApplicationFrameHost.exe
      4⤵
      Kills process with taskkill
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"
    3⤵
    PID:4504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im dwm.exe"
    3⤵
    PID:4028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im dwm.exe
      4⤵
      Kills process with taskkill
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im taskmgr.exe"
    3⤵
    PID:5852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /f /im ShellExperienceHost.exe"
    3⤵
    PID:5996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ShellExperienceHost.exe
      4⤵
      Kills process with taskkill
      PID:3332

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5340

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5612

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4220

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4824

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4088

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3945855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocker.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\blocker.dll
Size 5.6MB
SHA256 69819e89b98e8e004f44f1decb08b62e96e6afed7b2441b62ff1caae0670367c
MD5 18b3ebfbc656f79d95d20afc64dbd663
SHA1 9e2e8765ab595a2e1f51f4d12fb040e86233fccb
SHA512 209902dec5c0466dcacccb8ae0e4c81977341b3b83f389cc4a27b3bc00ae018f036d113b11cb26cdf3027eed6c6ee4b6a2c70f2ddee22afdc3af7e3fc0bc0a90
SSDEEP 49152:L4ry3f8NLoj/a5kZxbhz027dh2DShbSURdf7HcuZeAV8u0+8NyoHBgtxpBgshY:1kiP7v2DSprf7HcuZeAV8u0+8NyoHCV
TLSH
T1E44628817A92D5BBFC95F3B5841B060AB364C4F6B300C71335AEC06AAF5BBA46D614DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2416_236108_jU1veWAOzaE\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads