Overview

overview

10

Static

static

3

Seven.exe

windows10-2004-x64

1

Seven.exe

windows11-21h2-x64

1

Seven.exe

windows10-2004-x64

10

Seven.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/04/2024, 02:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Seven.exe

  • Size

    139KB

  • MD5

    350273e0d2e8a9ba5e37b791016112a0

  • SHA1

    5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71

  • SHA256

    27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba

  • SHA512

    b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b

  • SSDEEP

    3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct

Score
10/10
evasionransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Renames multiple (265) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Blocks application from running via registry modification 1 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 29 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Seven.exe
    "C:\Users\Admin\AppData\Local\Temp\Seven.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Blocks application from running via registry modification
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Sets desktop wallpaper using registry
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3984
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\Winhost.exe
      2⤵
        PID:4544
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\Winhost.exe
        2⤵
        • Drops file in System32 directory
        PID:2244
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Public\Documents\Winhost.exe
        2⤵
          PID:2628
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C attrib +h C:\Windows\System32\Winhost.exe
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Windows\system32\attrib.exe
            attrib +h C:\Windows\System32\Winhost.exe
            3⤵
            • Drops file in System32 directory
            • Views/modifies file attributes
            PID:1844
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C attrib +h C:\Users\Public\Documents\Winhost.exe
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4416
          • C:\Windows\system32\attrib.exe
            attrib +h C:\Users\Public\Documents\Winhost.exe
            3⤵
            • Views/modifies file attributes
            PID:3272
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll
          2⤵
          • Drops file in System32 directory
          PID:1396
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Users\Public\Documents\Seven.dll
          2⤵
            PID:4796
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json
            2⤵
            • Drops file in System32 directory
            PID:1240
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Users\Public\Documents\Seven.runtimeconfig.json
            2⤵
              PID:1716
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3196
              • C:\Windows\system32\attrib.exe
                attrib +h C:\Windows\System32\Seven.dll
                3⤵
                • Drops file in System32 directory
                • Views/modifies file attributes
                PID:952
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:964
              • C:\Windows\system32\attrib.exe
                attrib +h C:\Windows\System32\Seven.runtimeconfig.json
                3⤵
                • Drops file in System32 directory
                • Views/modifies file attributes
                PID:1676
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.dll
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2320
              • C:\Windows\system32\attrib.exe
                attrib +h C:\Users\Public\Documents\Seven.dll
                3⤵
                • Views/modifies file attributes
                PID:2860
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2136
              • C:\Windows\system32\attrib.exe
                attrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json
                3⤵
                • Views/modifies file attributes
                PID:3748
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C start C:\Users\Admin\AppData\Local\Temp\Winhost.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1796
              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                3⤵
                • Deletes itself
                • Executes dropped EXE
                • Drops desktop.ini file(s)
                • Sets desktop wallpaper using registry
                • Suspicious use of WriteProcessMemory
                PID:4688
                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                  4⤵
                  • Executes dropped EXE
                  • Sets desktop wallpaper using registry
                  • Suspicious use of WriteProcessMemory
                  PID:2436
                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3184
                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1192
                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2540
                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2152
                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                            9⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2260
                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3564
                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3000
                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:2456
                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    PID:4548
                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                      14⤵
                                      • Executes dropped EXE
                                      PID:2364
                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                        15⤵
                                        • Executes dropped EXE
                                        PID:964
                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                          16⤵
                                          • Executes dropped EXE
                                          PID:2512
                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                            17⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            PID:4240
                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                              18⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              PID:3668
                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                19⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:3060
                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                  20⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:2640
                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                    21⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    PID:2092
                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                      22⤵
                                                      • Executes dropped EXE
                                                      PID:4016
                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                        23⤵
                                                        • Executes dropped EXE
                                                        PID:2592
                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                          24⤵
                                                          • Executes dropped EXE
                                                          PID:4008
                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                            25⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            PID:3180
                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                              26⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              PID:4392
                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                27⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:548
                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                  28⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  PID:1192
                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                    29⤵
                                                                    • Executes dropped EXE
                                                                    PID:4132
                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                      30⤵
                                                                      • Executes dropped EXE
                                                                      PID:4656
                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                        31⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        PID:3788
                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                          32⤵
                                                                          • Executes dropped EXE
                                                                          PID:704
                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                            33⤵
                                                                            • Executes dropped EXE
                                                                            PID:2408
                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                              34⤵
                                                                              • Executes dropped EXE
                                                                              PID:1172
                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                35⤵
                                                                                • Executes dropped EXE
                                                                                PID:2348
                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                  36⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  PID:536
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                    37⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2736
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                      38⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      PID:4372
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                        39⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        PID:3368
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                          40⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          PID:3540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                            41⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            PID:5096
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                              42⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              PID:1716
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                43⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2360
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                  44⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1708
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                    45⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3552
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                      46⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3592
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                        47⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4268
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                          48⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3056
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                            49⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:3480
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                              50⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4880
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                51⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4708
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                  52⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4452
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                    53⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4512
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                      54⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:1784
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                        55⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4380
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                          56⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4632
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                            57⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2140
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              58⤵
                                                                                                                                PID:1172
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                58⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5076
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                  59⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:5072
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                    60⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1300
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                      61⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3200
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                        62⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1028
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                          63⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1784
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                            64⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4912
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                              65⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1464
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                66⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2904
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                  67⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:1600
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    68⤵
                                                                                                                                                      PID:5076
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                      68⤵
                                                                                                                                                        PID:2336
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                          69⤵
                                                                                                                                                            PID:4016
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              70⤵
                                                                                                                                                                PID:1300
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                70⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                PID:1988
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                  71⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  PID:5112
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                    72⤵
                                                                                                                                                                      PID:1472
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                        73⤵
                                                                                                                                                                          PID:4848
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                            74⤵
                                                                                                                                                                              PID:1360
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                75⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                PID:3196
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                  76⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  PID:1052
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                    77⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    PID:772
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                      78⤵
                                                                                                                                                                                        PID:3592
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                          79⤵
                                                                                                                                                                                            PID:1216
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              80⤵
                                                                                                                                                                                                PID:1028
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                80⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:2388
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  PID:3480
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    82⤵
                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:1360
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                        83⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:2644
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                          84⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            PID:4268
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            PID:220
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              PID:2836
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                  PID:1928
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        PID:1352
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                              PID:3016
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                                              PID:5016
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    PID:4804
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      PID:1144
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                            PID:3580
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  PID:3056
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                        PID:4400
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                                                            PID:4328
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                        PID:2252
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                            PID:1688
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                PID:2352
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                  PID:3176
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                  PID:772
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:812
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:636
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2152
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3580
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:700
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                                                                        • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                PID:548
                                                                                                                                                                                                                                                                • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                    • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      PID:3180
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                          PID:2504
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                                  PID:1384
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                              PID:2772
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                  PID:1424
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                                                                                                      PID:1828
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                              PID:4804
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                PID:4868
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                        PID:1368
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                            25⤵
                                                                                                                                                                                                                                                                                                                                              PID:1140
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1820
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4584
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                        28⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1660
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                            33⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                34⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                    35⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                        36⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1432
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                            37⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1680
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Winhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\Winhost.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    39⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1036

                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                        Defacement

                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                        T1491

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.1.filtertrie.intermediate.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          16B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          e8aaa566651759e399714d464cdfb390

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          373942a3618c8d5ff0ba8aab8e22d4a64e5641ae

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          1a4a61c3ade192d7f35bb5879ba1493ac39369579eaf9f73c72c44a9ecfa3a6a

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          23f835ffc6cfa06b864ee0f945dc844cb88aa1b0ab3cf2d0f8bf616c9a7446a563875ebd04f1b23d86d5a20ccc1a2cacd3e199c228cd73e8652c6f9e34b55ce2

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{9341b00b-3c0d-4d61-852c-de825c5f186d}\0.2.filtertrie.intermediate.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          16B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          209371fb985ae536f7a01b2cbf06fdeb

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6e5d735e5a6aef442f3342931eaf47d505763578

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          4cef54ede857b123a2b675fdce8147dbcc1a7c4d471ec5bfd8791f9e2ad9c0b3

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          53203c3447837fc04d0114f282e5b1efaeb1e81a90a9d50bd6384bd44823ab70c37f12aca73a52f803ba61a11ed3d7fd05ea04f79fc969212dce946df89b8bbe

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579836733239332.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          77KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          c0884ce2dd60d440f4fa378fa948da45

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          b2b1c4ceb82ca22b81aee582d7d1a83bd402d19f

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          8c68ef1ada6b6997f2449e4e77ec2f45a916d4532581c84da7ccd5eef2ab6480

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          e171e0eca50b2131cbf541867fc2e9cdcf0dff7368878904ffb7c835e75e337070555a1c67f09d1873aedaca1759664a40ca7fce0e48ac7f5afa100c8517a967

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579839229142017.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          47KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          a7f497d5930f461b796f448c15182fe9

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          9eafedf0c3d8be535ca3449bb68b00c5123e23fb

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          20758b7f599997f4c529ac8264a169b1bbd46d9362ffe9629e863792215a0131

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          fd6e91b82f6746ffe4bbbd92747ac6b1de2e872e4c80fc372469f1a3e2b7cd001eeea9a05e352d901c1ce50021604ff986b98c42ba10e7bdd5a9cc1f243df0e7

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579846343471163.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          66KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4a90573d4e1350bb3cb06a825fbd66de

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          3f3ce3606d802cd06dda067fa2a07dfa745c90df

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          5a74f880421a86087c44f74e3c105c9ec4fd4b1eae138984644c3d51d3e55242

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          b09feba996e833c149a309cb45f56e79998cbdeb7fce71c15ef99a1615468aa62fd4c9b1cf3a4f802c27558a75db4c0885f84d65b1fdee979abde314d07c208c

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133579891863520008.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          75KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          ab69555e8ae9d8ff1de5605724761c5f

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          3e09f9b5cfaf45fb19a8ff5c3ff884f570015171

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          358df7dc00b3290428a7551c7ea07259efbcd6afee694654809819d1ef6604e5

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          5c372847305cf5157b59e0479367560e3e36291055c93f80e41c33d2a711d35d2009cf314b06ec0c5b925d690957d14ee86218d9b4f9afb1d8883f70cd05793b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EncryptedLog.txt
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          163B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5cfb7a7c85e8aed145ea1efd37fb859f

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          964a5fcbe6d31f48b8eced39806384ed59c5ad5b

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          01c65d1514a1c18e7cf9d803d3e06df1dd939185ebe11691b885f144d6108792

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          7256fca2e194f4c61378d147d76cb7aff30e62d97963bcef7f4f7e1699806677e086b300540a4a13420e1dc0711b2ebf026240e10c5c7fcf31353c919d8efd39

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EncryptedLog.txt
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          80B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          dca1f64bbf7480fd1b83970ddfde1bbf

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          1b2235cdbc730a12c001c218682a68d0c014b03d

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          78ff86823bc9343f2d89ef4f53ba596c05b154f0eb898e3e45aad96a345553dc

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          524a2021578914aa63a1c8e6f60e1061f117656d45da41619f9d43af555bdac9013c65168dfca441e5e5f82700ae1a75970b24c4e3429d7283e89020cc10c7a9

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\EncryptedLog.txt
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          80B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          12ca842b01712549036992fa31861d73

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          579dde7fa8266313613cfd92bf572a405d516bb5

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          b1416919087e1f602baa14a1e222470a2d6431e7f0682fc42fed6975103ccc22

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          2327b6ef0cb36474df5a5be4613e951b2acc37020a8473d5c60c04490a2902337c0709324b2337fa362016d59f8af0247a69f718bbdbbf8aa346d7b7ed811ab3

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KeyAndIV.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          64B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          aa089042129e2b5be307a8f51683e4a4

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          fe1d662c040deeb970e265f94642ee48c7b9c5bc

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          14a4242852b2382d3a5fe2f76e2b8fb8e467c3cf14451799b7e827fa6fa7e99c

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          235a0592e213aeb43b4a8dd0563fa5007b58e9fc43cf31f869bc46204f339b909e13edb21ee56e51108a4a1e0fe8c1c3bdbd4a813df940c9dee71c5caa0df37b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KeyAndIV.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          64B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          25324e8f4c0766046cd3e589151843e6

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          45bf360b0aa3ce3f917b32e2a848d39399c8656b

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          b782b2d38ca7912b1ecd21bc974f8c109911eee86f1d1678a0a817afe8864246

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          31f1f1ac9c674790f989ef3daeefcd5927491e393b432d0c3850307cffc20d974be5b620ae54d7c13eccffb04b913bef1dc669ddc49257e9333a9cfe0b40f60f

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1wcwj0zb.xu4.ps1
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          60B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Seven.dll
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5d29aa7c5ee58718a4b046cf915097d1

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          22e5b157bf59615b05be2732549c71fa416f2d5a

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          6111311668c661d73aea8919bf85fa36048fb514335f43db67aa865351a61eaa

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          61a51e0d2d9cb4f193793ed95ad45986e2999ca1b3984c3296c0df8b8eb45c3002c4630857f1877ce02cb1de37e17ea0573a905c5542103bb99fb2bdb760d670

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Seven.runtimeconfig.json
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          340B

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          253333997e82f7d44ea8072dfae6db39

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          03b9744e89327431a619505a7c72fd497783d884

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\Winhost.exe
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          139KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          350273e0d2e8a9ba5e37b791016112a0

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2010_x64.log-MSI_vc_red.msi.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          379KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          1d7cbef39a663be776c999466ce89709

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          34b1f58d8789b06bc4a298a69fca439b1303fc27

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          7ae0dc16e50d313cc7a2119e8c6b4d0404fe122dad272e2c265e8938c03b21df

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          791ca438c3423cfb0c2fff990bda4de68a1ed4ae89ebd8fe7c51d302dced17383159cf3c9eb65c7aceb803ae04a650e7b477ffee27106055329d78c349b40704

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2010_x64.log.html.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          85KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          93520435d9ff6b5d7c8c14e1ce8682ba

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          f0012cb5e3e621b28bfcaa2a4a534b6f966fc06e

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          dec124055fca4d8d4338546745c85c807e6742667223931a8bc6f7c5235cb0a9

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          023c3a42644be721d47ea5e1b89b0ca7192a4550751570c5b13aa8cbae16eb0fca09540e4a0158812b8133b6a9bd79c162b24bf2a36c441973745f8f6fbee9e5

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          394KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5c254298f04715cb724d368567ce23cf

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6bbdff10fb25d5982e9cc1513ba290f8ba96d2b7

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          71d389d4c798ef47d17b9fdd964b5b8907391a2aa94ac5ba42a3b4390c3eadac

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          396569304cfce0dbb501b855cdacb80e10d9d8ce9eebae2160bae8bf81424d49af9f2ddef1ba018a80b5438d1fe09b49a968360491a23f059a6c3ddf28800569

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2010_x86.log.html.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4082680277c7a9a5cb24bcf54437d515

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          9311f0c9c0dd4a4ac64ec1868348857a8c850f5a

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          f7aff3469cc01370e7a12f1304ad7316fae0b2283fd05feff6e05ebcb65d67ce

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          02f0982c0e875dfa135b668989211eb8ca38471b7f4d5622fea6ad274030f17db3ef18bb1fc5f273c122dadafbe0750f53b59b341418576fb2fe114e27b3f003

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          167KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4c8becdea269c22622a27a7064373fab

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          8201ee66b2d5344ddada7ed882287ebec731c69c

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          3ef43d9efc874cfc1799ee9e36877c709f246d1136890edd9b66eabfe7de8452

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          83fafc53ff5b9e3fa913afbc35cfe0184a580f99e8ea9ca258a19e32d6c305088273c14fde00adb98ffbd1e5e7e392e4f265060b76442c36b903a5ca6501263e

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          195KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          afc26c27165ce60bb268d1dfb4fd6b9b

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          a3040adb23d05de98705cfd513b584619e4e2023

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          109ab7901a5e95401f14ba92e8860f86c3943e32788489096dd8b9cc7c3e9719

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          ec9582d0962c1fbc1fb09ce6a9f7ea19d0155f6c27cc2a69f3fbae8a90405f26b6cb15ab7b7383414622649aadf3d1583c54796d1cce66b3616a496eadc02fe3

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          170KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          ae413cbee0f159acd5234847455fabe2

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          1fea9a273c594e7d7da2a97f5b7bc639198569ab

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          6a7ce106a79a49acf2b95baeeeba337996a5568ddee225369e371232a26bb46b

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          70ced9eadb5a37b9a0bc029c77f4dd03fb6ff038c3c85e0efc05c92ddbd3efddeb03e36b11c7cc01f414ea41474a21593ce9e3ae5a80d3ea7313d06dac2ba8b6

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          208KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          b4602c6a035d69c84d30626623c7ef79

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          73d81d9fc11f46183fed7f6a6d0cdad88d1e1698

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          906a4e2114405f6b77fbed685a3cda98397c17f056ae6aee0a3d49aa663d5a8d

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          6c6f524fd7f67f0564514dc250b8b4cebb167771cb9e4d34c0f441a7d8d3d8c8f56d4544a14ac2d1b7bb213c8d9ae47f146f28f4fcbdec4634658dee048543cc

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          170KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          98c02ee7f6e815caf05b8289a3da9a2b

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          b87d68d87fa664ee8fcaf8b3cf59da2246609e78

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          12be07f0306c6df51635cf648c9130cac1f44617c442a7ea9d8a5255c0d4100b

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          541ea4e22f6f88c7709c026963511369875d33e7923ba7e46b26e3907b7011e8691b31c00157e960c0d642a508e1b68e306f133e2b6b38593accdf77d48e8a66

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          190KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4998f27071321de85cc5725bf3eb25fd

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          4ca43da4ffa374c91fa35dff01236a6e18431d50

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          de534e32464449f2d6261739fb970960f099782f51bec6d8516961dfa27c1616

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          4968ee50fd83b84a5844f1cc7517702a307e5a512bf5677efaaaab0f681135f066497fef42cc005b2c85a632dd4f6794e3aae05cffcec5aedfdfaba45fb8ff1d

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          170KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5f34cb2b40e6d40280be265efb72db65

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          fd82588be72ec6efd05542aa67ef16862f769949

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          94a6f5cda10884fc61c9c1d52034e77c09757cc48652f0a5e0a9267f0774de18

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          7499df435e030ff6cb6d7780e6e36b7da7d380d0c312b563f97120c07b09f1d010cd0c9671d138027a093eb46f1ef38802811e85045a8e3ea344360e851d665c

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          198KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d9700d9b28427af5b21e8cd10df13bbf

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          7dae1752160efc2977c056dd6d7c07aaf82c4486

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          7aec9be0f2ca58b753a7ddd61ae7534b5ef4a56394c3edc16852d233b42d25a0

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          7b3eab006e437bdd219b0ff51f058b37141d9fdcc73a39bb51f1383397cdb40d8c26b85c5a934d9e95cf6560d6b59c36a9d1f280f4ecb134cb67619701de3f06

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          123KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          87e4115729a5a760d100b822bf769e26

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          6166762e8f0e5488b497b1cdb379cda2cadb05eb

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          dd622abd24f01af330b738db55b19d737caa64e3e8082608bb7b7e411e8dc33c

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          cb17728967ebc3aa2e58ec539685928bb24098bb17ff22bf2822894b0614817c6a1e23c975644193fabab73e168123ae6b9b41809de6a6b196903fbf51238212

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          129KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          4b1c8da322fad35b949fd2f1fbc58e57

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          d491bb951c21135eb798a58bdc8d9c6716125398

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          e51be2daf3667fbfd63a240269ff08e554eb603f5f2a50e4822987ed64ddeeed

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          2399305fe347bafb95de852fb38619c5f808a56ff1af9ea69287259f5a7afe4e71d3890a0d41031da2a6282c6af690ffef01b18bd60229d29db1cc5f2babc7f4

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          123KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          d58c7adb8836b8be911beaab1e331505

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          780e887a8a0f33fbc53592a8c7d957b4ee61da02

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          f876b3d0e4fb7dbe6590bffb48678f2d7073a9d494c9092d4c8cc9626bfcb15a

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          33fb76f5b3c9437161bd0807dd62b30ed8cc190dd14cf439413ea8ae6b93cbde6f7c97db91311e0f04f2c78210121bfafd034c9a4a7876b9093e40357f7e422f

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.420
                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          135KB

                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                          5620450c65d8f54d2a1f01d45fa46fc6

                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                          0742afa2c4f40b714f6879424ab2bcbbaa419d45

                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                          62a1d3232351ad22ef5b1a5168a1993118b5ea8222828bdddb62ecd646f8060c

                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                          5fe75d1d1045b1c76d6c365469272d76b51049794c95ec4c0a9f997e928ac46fc775e25ecb6453db82565294e4b4bcf55f65450ba31745b00cc2e91dd9bf9cef

                                                                                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                                                                                        • memory/3984-16-0x00007FFEC0060000-0x00007FFEC0B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/3984-11-0x00007FFEC0060000-0x00007FFEC0B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/3984-1-0x000001E840AA0000-0x000001E840AC2000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/3984-13-0x000001E840B90000-0x000001E840BA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                        • memory/3984-12-0x000001E840B90000-0x000001E840BA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                          Download