Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 16:00

General

  • Target

    ransom/Release/ransom.exe

  • Size

    6.4MB

  • MD5

    626fab8275d8d8e841bc9a08b208201e

  • SHA1

    197d5c9c5cbf53ed3e78d53a008b6ad665fa3e4c

  • SHA256

    e26db13a9660555448acb7591f382b480b0252d19e3ad6c6678ba5e1f03d6458

  • SHA512

    e106cf78731d9a8e75b5e76ecf881bb12262f13b05b805e89f3bede061a4a1ebb738d7a7631fb51801d95717ca34dabb12f7ed4826e6812ceadb0bad98fcb0d0

  • SSDEEP

    6144:o3j7hJkMepmEfZsVOM7pNbDMuoKJ+QtDeQYizHMTlaw81FRx3JmfBcOmg:o3nkMS2R6RdQtzH8lhwFbZgaOm

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransom\Release\ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\ransom\Release\ransom.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4576
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:444
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1048
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3628
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4312
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1344
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4892
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:932
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3788
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2056
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2836
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im mmc.exe /t
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2964
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im mmc.exe /t
      2⤵
        PID:2288
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im mmc.exe /t
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4216
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c taskkill /f /im mmc.exe /t
        2⤵
          PID:60
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /im mmc.exe /t
            3⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4480
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c taskkill /f /im mmc.exe /t
          2⤵
            PID:540
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im mmc.exe /t
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1144
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im mmc.exe /t
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3984
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im mmc.exe /t
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4576
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im mmc.exe /t
            2⤵
              PID:3988
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im mmc.exe /t
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3448
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im mmc.exe /t
              2⤵
                PID:4092
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im mmc.exe /t
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:724
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im mmc.exe /t
                2⤵
                  PID:5028
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im mmc.exe /t
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4680
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im mmc.exe /t
                  2⤵
                    PID:1192
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im mmc.exe /t
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4472
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im mmc.exe /t
                    2⤵
                      PID:4200
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im mmc.exe /t
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1304
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im mmc.exe /t
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:852
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im mmc.exe /t
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4812
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im mmc.exe /t
                      2⤵
                        PID:3952
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im mmc.exe /t
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3636
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im mmc.exe /t
                        2⤵
                          PID:1504
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im mmc.exe /t
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3732
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im mmc.exe /t
                          2⤵
                            PID:1604
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im mmc.exe /t
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2472
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c taskkill /f /im mmc.exe /t
                            2⤵
                              PID:1528
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im mmc.exe /t
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3772
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c taskkill /f /im mmc.exe /t
                              2⤵
                                PID:2560
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im mmc.exe /t
                                  3⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1104
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im mmc.exe /t
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:392
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im mmc.exe /t
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3344
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c taskkill /f /im mmc.exe /t
                                2⤵
                                  PID:1732
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im mmc.exe /t
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5092
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                  2⤵
                                    PID:4928
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im mmc.exe /t
                                      3⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3884
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                    2⤵
                                      PID:4748
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im mmc.exe /t
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4564
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                      2⤵
                                        PID:4396
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im mmc.exe /t
                                          3⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2600
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                        2⤵
                                          PID:1144
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im mmc.exe /t
                                            3⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:540
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                          2⤵
                                            PID:4824
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im mmc.exe /t
                                              3⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:372
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1048
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im mmc.exe /t
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2352
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                            2⤵
                                              PID:2324
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im mmc.exe /t
                                                3⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3648
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                              2⤵
                                                PID:1812
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /f /im mmc.exe /t
                                                  3⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3132
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                2⤵
                                                  PID:4120
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im mmc.exe /t
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4660
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                  2⤵
                                                    PID:4504
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im mmc.exe /t
                                                      3⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3652
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1992
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im mmc.exe /t
                                                      3⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3172
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                    2⤵
                                                      PID:1868
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im mmc.exe /t
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4500
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2540
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /f /im mmc.exe /t
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3748
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                      2⤵
                                                        PID:4696
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f /im mmc.exe /t
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1400
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                        2⤵
                                                          PID:4856
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im mmc.exe /t
                                                            3⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4628
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                          2⤵
                                                            PID:1016
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im mmc.exe /t
                                                              3⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3664
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                            2⤵
                                                              PID:1832
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im mmc.exe /t
                                                                3⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1788
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                              2⤵
                                                                PID:2872
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /f /im mmc.exe /t
                                                                  3⤵
                                                                  • Kills process with taskkill
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5096
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                2⤵
                                                                  PID:2376
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /f /im mmc.exe /t
                                                                    3⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2712
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                  2⤵
                                                                    PID:3460
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /f /im mmc.exe /t
                                                                      3⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:540
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                    2⤵
                                                                      PID:3464
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /f /im mmc.exe /t
                                                                        3⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4160
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                      2⤵
                                                                        PID:2972
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /f /im mmc.exe /t
                                                                          3⤵
                                                                          • Kills process with taskkill
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:464
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                        2⤵
                                                                          PID:1356
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im mmc.exe /t
                                                                            3⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2660
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                          2⤵
                                                                            PID:1652
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /f /im mmc.exe /t
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:4084
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                            2⤵
                                                                              PID:4876
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im mmc.exe /t
                                                                                3⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:3876
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                              2⤵
                                                                                PID:2516
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /f /im mmc.exe /t
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4812
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                2⤵
                                                                                  PID:1812
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /f /im mmc.exe /t
                                                                                    3⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3340
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                  2⤵
                                                                                    PID:1304
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /f /im mmc.exe /t
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2852
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4920
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /f /im mmc.exe /t
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Kills process with taskkill
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3636
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                    2⤵
                                                                                      PID:1504
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /f /im mmc.exe /t
                                                                                        3⤵
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3652
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                      2⤵
                                                                                        PID:2900
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /f /im mmc.exe /t
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Kills process with taskkill
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2472
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                        2⤵
                                                                                          PID:3656
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /f /im mmc.exe /t
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3772
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                          2⤵
                                                                                            PID:5032
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im mmc.exe /t
                                                                                              3⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2836
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                            2⤵
                                                                                              PID:4696
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /f /im mmc.exe /t
                                                                                                3⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2964
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                              2⤵
                                                                                                PID:4800
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                  3⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:3532
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                2⤵
                                                                                                  PID:4480
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                    3⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1788
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                  2⤵
                                                                                                    PID:700
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                      3⤵
                                                                                                        PID:116
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                      2⤵
                                                                                                        PID:5096
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:2872
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                        2⤵
                                                                                                          PID:3200
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                            3⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:4144
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1096
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1080
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                          2⤵
                                                                                                            PID:444
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                              3⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2664
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3804
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                              3⤵
                                                                                                                PID:1048
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3628
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                3⤵
                                                                                                                  PID:4680
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                2⤵
                                                                                                                  PID:2704
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:4812
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                  2⤵
                                                                                                                    PID:3672
                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                      3⤵
                                                                                                                        PID:3340
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:452
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4592
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2976
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                        3⤵
                                                                                                                          PID:4820
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                        2⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3732
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                          3⤵
                                                                                                                            PID:1816
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                          2⤵
                                                                                                                            PID:1768
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                              3⤵
                                                                                                                                PID:4900
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2900
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                3⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:964
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                              2⤵
                                                                                                                                PID:1912
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                  3⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:4932
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4640
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                  3⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5104
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                2⤵
                                                                                                                                  PID:1396
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                    3⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:2560
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                  2⤵
                                                                                                                                    PID:3020
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                      3⤵
                                                                                                                                        PID:2540
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:5060
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                        3⤵
                                                                                                                                          PID:2964
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                        2⤵
                                                                                                                                          PID:4724
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:364
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                          2⤵
                                                                                                                                            PID:3120
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                              3⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3936
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                            2⤵
                                                                                                                                              PID:1788
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                3⤵
                                                                                                                                                  PID:3160
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                2⤵
                                                                                                                                                  PID:3076
                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                    3⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:3296
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1240
                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                      3⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1412
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5096
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:4652
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1144
                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                          3⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:4264
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1172
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                            3⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3464
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:760
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                            3⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:2352
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                          2⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:444
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:4452
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3236
                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                              3⤵
                                                                                                                                                                PID:432
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2876
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:3124
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3512
                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5084
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1512
                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4460
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                        2⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5116
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:2840
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:452
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:2408
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4740
                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:3392
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1868
                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:4268
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1324
                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4228
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1568
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:3140
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3356
                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                        PID:2872
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2200
                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3928
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2992
                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:3956
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3988
                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1356
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:2216
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:4716
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:372
                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1428
                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:864
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2892
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4868
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4660
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2580
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1324
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5048
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:852
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:5052
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4240
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2992
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:636
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2160
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                          PID:232
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2040
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3360
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2472
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                        taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4820
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                    PID:116
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4440
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                    taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                      taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2600
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                          taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2076
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                            taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1200
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:3356
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                              taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:2872
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:5076
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill /f /im mmc.exe /t
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1508

                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                    Downloads