Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 23:16

General

  • Target

    a09880e53ebc8c020376de61d7a21efc.exe

  • Size

    277KB

  • MD5

    a09880e53ebc8c020376de61d7a21efc

  • SHA1

    02405fae61c1f50e16f95a954eb8d1e972a05aad

  • SHA256

    74168ffe0ac7ae5e91e3cffd8d1d0fbc096aae558812aee4af0b283867e8646a

  • SHA512

    5fb3b360d1c424a12ff4a7abeb32303508a89f1108a81a8a96a170aacd18310e868d3a1e558ef5b61e491c98e8cb317929d5e699c41840a1db06f27cb4a7f697

  • SSDEEP

    6144:kcOmqI0l3DKSRau154KtPNaHbjTDGiy56d6i4oMmA:FOmWl5L15tNQbrGL5TBoMB

Malware Config

Extracted

Family

darkcomet

Botnet

Bac

C2

microsoft2011.servehttp.com:48445

Mutex

RTS0KDT

Attributes
  • InstallPath

    System32\svchost.exe

  • gencode

    32tD5p6h4x3R

  • install

    true

  • offline_keylogger

    true

  • password

    picaso951753852

  • persistence

    true

  • reg_key

    svchost

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 57 IoCs
  • Sets file to hidden 1 TTPs 64 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 57 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 57 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe
    "C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe
      C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\a09880e53ebc8c020376de61d7a21efc.exe" +s +h
          4⤵
          • Sets file to hidden
          PID:4884
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3768
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1248
      • C:\Windows\SysWOW64\System32\svchost.exe
        "C:\Windows\system32\System32\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\SysWOW64\System32\svchost.exe
          C:\Windows\SysWOW64\System32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:796
            • C:\Windows\SysWOW64\attrib.exe
              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
              6⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:112
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2976
            • C:\Windows\SysWOW64\attrib.exe
              attrib "C:\Windows\SysWOW64\System32" +s +h
              6⤵
              • Sets file to hidden
              • Views/modifies file attributes
              PID:1796
          • C:\Windows\SysWOW64\System32\svchost.exe
            "C:\Windows\system32\System32\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1664
            • C:\Windows\SysWOW64\System32\svchost.exe
              C:\Windows\SysWOW64\System32\svchost.exe
              6⤵
              • Modifies WinLogon for persistence
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:592
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3960
                • C:\Windows\SysWOW64\attrib.exe
                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                  8⤵
                    PID:4284
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3496
                  • C:\Windows\SysWOW64\attrib.exe
                    attrib "C:\Windows\SysWOW64\System32" +s +h
                    8⤵
                      PID:4384
                  • C:\Windows\SysWOW64\System32\svchost.exe
                    "C:\Windows\system32\System32\svchost.exe"
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3824
                    • C:\Windows\SysWOW64\System32\svchost.exe
                      C:\Windows\SysWOW64\System32\svchost.exe
                      8⤵
                      • Modifies WinLogon for persistence
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      PID:2148
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                        9⤵
                          PID:2608
                          • C:\Windows\SysWOW64\attrib.exe
                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                            10⤵
                            • Drops file in System32 directory
                            • Views/modifies file attributes
                            PID:2124
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                          9⤵
                            PID:1284
                            • C:\Windows\SysWOW64\attrib.exe
                              attrib "C:\Windows\SysWOW64\System32" +s +h
                              10⤵
                              • Sets file to hidden
                              PID:2832
                          • C:\Windows\SysWOW64\System32\svchost.exe
                            "C:\Windows\system32\System32\svchost.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3432
                            • C:\Windows\SysWOW64\System32\svchost.exe
                              C:\Windows\SysWOW64\System32\svchost.exe
                              10⤵
                              • Modifies WinLogon for persistence
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies registry class
                              PID:3584
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                11⤵
                                  PID:1080
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                    12⤵
                                    • Drops file in System32 directory
                                    • Views/modifies file attributes
                                    PID:4460
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                  11⤵
                                    PID:2640
                                    • C:\Windows\SysWOW64\attrib.exe
                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                      12⤵
                                        PID:2060
                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                      "C:\Windows\system32\System32\svchost.exe"
                                      11⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:3600
                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                        C:\Windows\SysWOW64\System32\svchost.exe
                                        12⤵
                                        • Modifies WinLogon for persistence
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in System32 directory
                                        • Modifies registry class
                                        PID:4500
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                          13⤵
                                            PID:4764
                                            • C:\Windows\SysWOW64\attrib.exe
                                              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                              14⤵
                                              • Sets file to hidden
                                              • Views/modifies file attributes
                                              PID:4576
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                            13⤵
                                              PID:4464
                                              • C:\Windows\SysWOW64\attrib.exe
                                                attrib "C:\Windows\SysWOW64\System32" +s +h
                                                14⤵
                                                • Sets file to hidden
                                                PID:3948
                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                              "C:\Windows\system32\System32\svchost.exe"
                                              13⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:1720
                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                C:\Windows\SysWOW64\System32\svchost.exe
                                                14⤵
                                                • Modifies WinLogon for persistence
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:3604
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                  15⤵
                                                    PID:4920
                                                    • C:\Windows\SysWOW64\attrib.exe
                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                      16⤵
                                                      • Sets file to hidden
                                                      • Views/modifies file attributes
                                                      PID:1868
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                    15⤵
                                                      PID:3556
                                                      • C:\Windows\SysWOW64\attrib.exe
                                                        attrib "C:\Windows\SysWOW64\System32" +s +h
                                                        16⤵
                                                        • Sets file to hidden
                                                        • Drops file in System32 directory
                                                        • Views/modifies file attributes
                                                        PID:4928
                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                      "C:\Windows\system32\System32\svchost.exe"
                                                      15⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:3904
                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                        C:\Windows\SysWOW64\System32\svchost.exe
                                                        16⤵
                                                        • Modifies WinLogon for persistence
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • Modifies registry class
                                                        PID:4140
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                          17⤵
                                                            PID:3352
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                              18⤵
                                                              • Views/modifies file attributes
                                                              PID:1316
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                            17⤵
                                                              PID:1064
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                18⤵
                                                                • Sets file to hidden
                                                                • Views/modifies file attributes
                                                                PID:1268
                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                              "C:\Windows\system32\System32\svchost.exe"
                                                              17⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:3868
                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                C:\Windows\SysWOW64\System32\svchost.exe
                                                                18⤵
                                                                • Modifies WinLogon for persistence
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                • Modifies registry class
                                                                PID:688
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                  19⤵
                                                                    PID:208
                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                      20⤵
                                                                        PID:4020
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                      19⤵
                                                                        PID:4780
                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                          20⤵
                                                                          • Views/modifies file attributes
                                                                          PID:4156
                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                        19⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:2908
                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                          20⤵
                                                                          • Modifies WinLogon for persistence
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Drops file in System32 directory
                                                                          • Modifies registry class
                                                                          PID:4748
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                            21⤵
                                                                              PID:1124
                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                22⤵
                                                                                • Drops file in System32 directory
                                                                                PID:2312
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                              21⤵
                                                                                PID:1104
                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                  22⤵
                                                                                  • Sets file to hidden
                                                                                  PID:824
                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                21⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:3964
                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                  22⤵
                                                                                  • Modifies WinLogon for persistence
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • Modifies registry class
                                                                                  PID:3604
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                    23⤵
                                                                                      PID:4392
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                        24⤵
                                                                                        • Views/modifies file attributes
                                                                                        PID:4624
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                      23⤵
                                                                                        PID:1892
                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                          24⤵
                                                                                          • Sets file to hidden
                                                                                          • Views/modifies file attributes
                                                                                          PID:4460
                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                        23⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:2144
                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                          24⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • Drops file in System32 directory
                                                                                          • Modifies registry class
                                                                                          PID:2812
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                            25⤵
                                                                                              PID:4468
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                26⤵
                                                                                                • Sets file to hidden
                                                                                                PID:1008
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                              25⤵
                                                                                                PID:4860
                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                  26⤵
                                                                                                    PID:2164
                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                  "C:\Windows\system32\System32\svchost.exe"
                                                                                                  25⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:3600
                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                    C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                    26⤵
                                                                                                    • Modifies WinLogon for persistence
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    • Modifies registry class
                                                                                                    PID:4540
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                      27⤵
                                                                                                        PID:368
                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                          attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                          28⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          • Views/modifies file attributes
                                                                                                          PID:3016
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                        27⤵
                                                                                                          PID:5100
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                            28⤵
                                                                                                              PID:320
                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                            27⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            PID:5084
                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                              28⤵
                                                                                                              • Modifies WinLogon for persistence
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Adds Run key to start application
                                                                                                              • Modifies registry class
                                                                                                              PID:3552
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                29⤵
                                                                                                                  PID:3776
                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                    30⤵
                                                                                                                    • Sets file to hidden
                                                                                                                    • Views/modifies file attributes
                                                                                                                    PID:1056
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                  29⤵
                                                                                                                    PID:2268
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                      30⤵
                                                                                                                      • Sets file to hidden
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:2128
                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                    29⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    PID:2076
                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                      30⤵
                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Adds Run key to start application
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Modifies registry class
                                                                                                                      PID:1804
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                        31⤵
                                                                                                                          PID:4300
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                            32⤵
                                                                                                                            • Sets file to hidden
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:4116
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                          31⤵
                                                                                                                            PID:1824
                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                              32⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:5084
                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                            31⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            PID:2176
                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                              32⤵
                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Adds Run key to start application
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • Modifies registry class
                                                                                                                              PID:4060
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                33⤵
                                                                                                                                  PID:2540
                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                    34⤵
                                                                                                                                    • Sets file to hidden
                                                                                                                                    • Views/modifies file attributes
                                                                                                                                    PID:2300
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                  33⤵
                                                                                                                                    PID:2004
                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                      34⤵
                                                                                                                                        PID:4148
                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                      "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                      33⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2136
                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                        C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                        34⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:1724
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                          35⤵
                                                                                                                                            PID:2932
                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                              36⤵
                                                                                                                                                PID:1248
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                              35⤵
                                                                                                                                                PID:3028
                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                  36⤵
                                                                                                                                                  • Sets file to hidden
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:5084
                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                35⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                PID:4156
                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                  36⤵
                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:4356
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                    37⤵
                                                                                                                                                      PID:1100
                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                        38⤵
                                                                                                                                                        • Sets file to hidden
                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                        PID:2664
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                      37⤵
                                                                                                                                                        PID:2176
                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                          38⤵
                                                                                                                                                          • Sets file to hidden
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:4308
                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                        37⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                        PID:3260
                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                          38⤵
                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          PID:4328
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                            39⤵
                                                                                                                                                              PID:4232
                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                40⤵
                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                PID:2192
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                              39⤵
                                                                                                                                                                PID:2316
                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                  40⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:2024
                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                39⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                PID:3260
                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                  40⤵
                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:3600
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                    41⤵
                                                                                                                                                                      PID:3940
                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                        42⤵
                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:5124
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                      41⤵
                                                                                                                                                                        PID:2428
                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                          42⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:5132
                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                        41⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        PID:5160
                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                          42⤵
                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:5192
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                            43⤵
                                                                                                                                                                              PID:5296
                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                44⤵
                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                PID:5376
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                              43⤵
                                                                                                                                                                                PID:5312
                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                  44⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:5396
                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                43⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                PID:5416
                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                  44⤵
                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:5452
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:5556
                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                        46⤵
                                                                                                                                                                                          PID:5636
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                        45⤵
                                                                                                                                                                                          PID:5584
                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                            46⤵
                                                                                                                                                                                              PID:5660
                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                            45⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            PID:5688
                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                              46⤵
                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:5724
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                47⤵
                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                        49⤵
                                                                                                                                                                                                          PID:6120
                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                            50⤵
                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                            PID:836
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                              PID:5188
                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                            49⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                              50⤵
                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                  PID:5424
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                    PID:5476
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      PID:3204
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                          PID:1352
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:5760
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                            PID:3692
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                              PID:5528
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            PID:5776
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                        PID:6056
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                              PID:6104
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                PID:556
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                        PID:3688
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                          PID:5688
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:5704
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          PID:3752
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                              PID:5780
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                PID:5788
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                      PID:2424
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                        PID:4132
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                          PID:1608
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                66⤵
                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                PID:6000
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                  PID:3280
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                PID:5552
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                    67⤵
                                                                                                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                          68⤵
                                                                                                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                          67⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                          PID:2340
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                            68⤵
                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                              69⤵
                                                                                                                                                                                                                                                                                                PID:4868
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                69⤵
                                                                                                                                                                                                                                                                                                  PID:1608
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                    70⤵
                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                        PID:1912
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                          PID:2488
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                        71⤵
                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:5800
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                              73⤵
                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                    74⤵
                                                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                    PID:4396
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                      75⤵
                                                                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                          76⤵
                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                        75⤵
                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                            PID:4028
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                          PID:5220
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                            PID:5052
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                                                                                                                PID:3152
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                    PID:3864
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                    PID:5644
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                      78⤵
                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                        79⤵
                                                                                                                                                                                                                                                                                                                                          PID:6068
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                              PID:5540
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            PID:5480
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                              PID:5548
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                            79⤵
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                            PID:1576
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                              80⤵
                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              PID:5220
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                PID:5644
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                  PID:6160
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5408
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                    81⤵
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                    PID:6180
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      PID:6200
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6312
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                            84⤵
                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                            PID:6404
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6328
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                              PID:6412
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                              PID:6460
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                85⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6568
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                    PID:6652
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6576
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                      PID:6672
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                    PID:6688
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                      PID:6756
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6852
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                            PID:6932
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6888
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                              PID:6956
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                            87⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                            PID:6976
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:7012
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:7144
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                    PID:5672
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7120
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                    PID:6216
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6404
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                            PID:6496
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1408
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6244
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                              PID:6512
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6864
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:6848
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7064
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7132
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7096
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6504
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                        102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6844
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6384
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Sets file to hidden
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\System32\svchost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      attrib "C:\Windows\SysWOW64\System32\svchost.exe" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          attrib "C:\Windows\SysWOW64\System32" +s +h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7436

                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    277KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    a09880e53ebc8c020376de61d7a21efc

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    02405fae61c1f50e16f95a954eb8d1e972a05aad

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    74168ffe0ac7ae5e91e3cffd8d1d0fbc096aae558812aee4af0b283867e8646a

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    5fb3b360d1c424a12ff4a7abeb32303508a89f1108a81a8a96a170aacd18310e868d3a1e558ef5b61e491c98e8cb317929d5e699c41840a1db06f27cb4a7f697

                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\System32\svchost.exe

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                    b481d31fea2d4a2d7db902cd931b0b66

                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                    d45f09a5349dbf3abdf1264311727280dc872fed

                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                    4a12b8b1e8d5983573bbe0a82719fa10f9bff695aea8a043012c123193c42224

                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                    c9326462d711f682263d115e94a709c565b302edf44d46dd9f56bd7c9d0fcbe132a346bc4790684fc823e71476b028f43bbc5e2e6963c0f8583ea453451fbac0

                                                                                                                                                                                                                                                                  • memory/592-115-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-111-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-107-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-109-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-108-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-106-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/592-105-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/688-209-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/688-219-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-13-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-16-0x0000000002510000-0x0000000002511000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/1436-3-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-79-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-2-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-15-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-7-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-9-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-10-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-11-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1436-12-0x0000000002220000-0x0000000002223000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/1664-103-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/1720-174-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/1724-349-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/1804-321-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/2076-313-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2136-335-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2136-338-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2144-258-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2148-130-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/2176-329-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2812-261-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/2812-260-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/2812-271-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/2908-226-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/2908-215-0x00000000001E0000-0x00000000001E3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/3260-374-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3432-129-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3432-136-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3504-87-0x00000000001E0000-0x00000000001E3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/3504-85-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3504-78-0x00000000001E0000-0x00000000001E3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/3552-305-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3552-297-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-146-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-141-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-138-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-139-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-144-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3584-142-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3600-152-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3600-279-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3600-268-0x00000000001E0000-0x00000000001E3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/3600-267-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3604-182-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3604-251-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3604-243-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/3824-114-0x00000000001E0000-0x00000000001E3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/3824-113-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3824-122-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3868-208-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3904-190-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/3964-242-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/4060-345-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4140-200-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4140-194-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4140-192-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4156-357-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/4328-383-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4356-359-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4356-367-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4356-358-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4500-162-0x00000000025C0000-0x00000000025C1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/4500-160-0x0000000000C90000-0x0000000000C93000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/4500-156-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4500-158-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4500-166-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4540-288-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-89-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-94-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-92-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-91-0x0000000002430000-0x0000000002433000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/4628-90-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-88-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-97-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/4628-95-0x00000000025C0000-0x00000000025C1000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                  • memory/4748-234-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    732KB

                                                                                                                                                                                                                                                                  • memory/5044-6-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/5044-8-0x00000000001C0000-0x00000000001C3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/5044-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    12KB

                                                                                                                                                                                                                                                                  • memory/5044-0-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/5084-295-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB

                                                                                                                                                                                                                                                                  • memory/5084-285-0x0000000000400000-0x000000000049F000-memory.dmp

                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                    636KB