remcos | 6de3b5982be4aa09debda91604b1dbbec315f20acd900a96468653aaeab197a5

Analysis

max time kernel
1050s
max time network
835s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zyx.exe
Size

469KB
MD5

cce8602cd68aaf435c7ce42721867662
SHA1

6adbaa34a641b06b7580191f5dd24c1e82aab6de
SHA256

6de3b5982be4aa09debda91604b1dbbec315f20acd900a96468653aaeab197a5
SHA512

ed5357cb5d8c8139b8e918d3b75914b2a8523c09df81d7976df4d4c1a411e16262b509459384bb8ea92b89e5de1d5a655464719800e0da67ff4668005ea063e9
SSDEEP

12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQS8n9:uiLJbpI7I2WhQqZ789

Score

10^/10

remcos remotehost discovery evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

camera-ms.gl.at.ply.gg:50534

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
system.exe
copy_folder
Remcos
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-3KI5BX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes itself 1 IoCs

pid	Process
2088	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2436	system.exe

Loads dropped DLL 2 IoCs

pid	Process
2928	cmd.exe
2928	cmd.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	zyx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	zyx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\""	iexplore.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Remcos	zyx.exe
File opened for modification	C:\Windows\SysWOW64\Remcos	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Remcos\system.exe	iexplore.exe
File created	C:\Windows\SysWOW64\Remcos\system.exe	zyx.exe
File opened for modification	C:\Windows\SysWOW64\Remcos\system.exe	zyx.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 2752	2436	system.exe	38
PID 2752 set thread context of 2628	2752	iexplore.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2080	reg.exe
2720	reg.exe
2632	reg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2436	system.exe
2752	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2988	2688	zyx.exe	30
PID 2688 wrote to memory of 2988	2688	zyx.exe	30
PID 2688 wrote to memory of 2988	2688	zyx.exe	30
PID 2688 wrote to memory of 2988	2688	zyx.exe	30
PID 2688 wrote to memory of 2088	2688	zyx.exe	32
PID 2688 wrote to memory of 2088	2688	zyx.exe	32
PID 2688 wrote to memory of 2088	2688	zyx.exe	32
PID 2688 wrote to memory of 2088	2688	zyx.exe	32
PID 2988 wrote to memory of 2080	2988	cmd.exe	33
PID 2988 wrote to memory of 2080	2988	cmd.exe	33
PID 2988 wrote to memory of 2080	2988	cmd.exe	33
PID 2988 wrote to memory of 2080	2988	cmd.exe	33
PID 2088 wrote to memory of 2928	2088	WScript.exe	34
PID 2088 wrote to memory of 2928	2088	WScript.exe	34
PID 2088 wrote to memory of 2928	2088	WScript.exe	34
PID 2088 wrote to memory of 2928	2088	WScript.exe	34
PID 2928 wrote to memory of 2436	2928	cmd.exe	36
PID 2928 wrote to memory of 2436	2928	cmd.exe	36
PID 2928 wrote to memory of 2436	2928	cmd.exe	36
PID 2928 wrote to memory of 2436	2928	cmd.exe	36
PID 2436 wrote to memory of 2744	2436	system.exe	37
PID 2436 wrote to memory of 2744	2436	system.exe	37
PID 2436 wrote to memory of 2744	2436	system.exe	37
PID 2436 wrote to memory of 2744	2436	system.exe	37
PID 2436 wrote to memory of 2752	2436	system.exe	38
PID 2436 wrote to memory of 2752	2436	system.exe	38
PID 2436 wrote to memory of 2752	2436	system.exe	38
PID 2436 wrote to memory of 2752	2436	system.exe	38
PID 2436 wrote to memory of 2752	2436	system.exe	38
PID 2752 wrote to memory of 2728	2752	iexplore.exe	40
PID 2752 wrote to memory of 2728	2752	iexplore.exe	40
PID 2752 wrote to memory of 2728	2752	iexplore.exe	40
PID 2752 wrote to memory of 2728	2752	iexplore.exe	40
PID 2744 wrote to memory of 2720	2744	cmd.exe	41
PID 2744 wrote to memory of 2720	2744	cmd.exe	41
PID 2744 wrote to memory of 2720	2744	cmd.exe	41
PID 2744 wrote to memory of 2720	2744	cmd.exe	41
PID 2728 wrote to memory of 2632	2728	cmd.exe	43
PID 2728 wrote to memory of 2632	2728	cmd.exe	43
PID 2728 wrote to memory of 2632	2728	cmd.exe	43
PID 2728 wrote to memory of 2632	2728	cmd.exe	43
PID 2752 wrote to memory of 2628	2752	iexplore.exe	44
PID 2752 wrote to memory of 2628	2752	iexplore.exe	44
PID 2752 wrote to memory of 2628	2752	iexplore.exe	44
PID 2752 wrote to memory of 2628	2752	iexplore.exe	44
PID 2752 wrote to memory of 2628	2752	iexplore.exe	44
PID 2752 wrote to memory of 1052	2752	iexplore.exe	47
PID 2752 wrote to memory of 1052	2752	iexplore.exe	47
PID 2752 wrote to memory of 1052	2752	iexplore.exe	47
PID 2752 wrote to memory of 1052	2752	iexplore.exe	47
PID 1052 wrote to memory of 1860	1052	cmd.exe	49
PID 1052 wrote to memory of 1860	1052	cmd.exe	49
PID 1052 wrote to memory of 1860	1052	cmd.exe	49
PID 1052 wrote to memory of 1860	1052	cmd.exe	49
PID 1052 wrote to memory of 1332	1052	cmd.exe	50
PID 1052 wrote to memory of 1332	1052	cmd.exe	50
PID 1052 wrote to memory of 1332	1052	cmd.exe	50
PID 1052 wrote to memory of 1332	1052	cmd.exe	50
PID 1052 wrote to memory of 1884	1052	cmd.exe	51
PID 1052 wrote to memory of 1884	1052	cmd.exe	51
PID 1052 wrote to memory of 1884	1052	cmd.exe	51
PID 1052 wrote to memory of 1884	1052	cmd.exe	51
PID 1052 wrote to memory of 2232	1052	cmd.exe	52
PID 1052 wrote to memory of 2232	1052	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\zyx.exe
"C:\Users\Admin\AppData\Local\Temp\zyx.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:2080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Remcos\system.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\Remcos\system.exe
      C:\Windows\SysWOW64\Remcos\system.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:2720
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:2632
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:2628
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DONT OPEN BOMB.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15472
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:14628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16412
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16700
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16808
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16932
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17104
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:15848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17552
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17944
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18292
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:16772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18456
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18672
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18944
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18996
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19444
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:17600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18008
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:18816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19484
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19732
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19784
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20072
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20264
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:19836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20592
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20832
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20948
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21056
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21092
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21164
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21404
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21420
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:20892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:21672
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gzicqhj.vbs"
        6⤵
        
        PID:7944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DONT OPEN BOMB.bat

Filesize
161B

MD5
82df6e9c10282d9c13af14bbae6626a5

SHA1
16d081d5cb44cb894c95ba41601b6e7a83587e25

SHA256
dd571f70b0843ead4deac4dbcefa959fb1b37fbe61d7e44600d606c136959c58

SHA512
75aa9554c6f16368b4993e2fcae76f551603a9c99263cd6de6a59398564aaee9047e6caddc040075b9be0e4ded6192ed95fd40662c10ea00d6025bf568e0a6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\gzicqhj.vbs

Filesize
560B

MD5
c0add116e665aca2f04ed038c6399441

SHA1
3bff7d3fb255ad159c9aee36f5c10a73c8bc3596

SHA256
daecfdf55ec8f0726e6b69ff85a25baf4b8287d93113a3aa5b3ecd272839daa6

SHA512
02d41f91d6ced10b2735b065db3c88569e14ea781a666016a644c7a7269fce12abbe004faa06fba966bb655ba74a3b2ff36ec0cd4153a4a8989a2c82f56e958a

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
514B

MD5
d33c5542ea26ac56ab50e678fb51bf10

SHA1
7eb629ddf7925df85b76256ae75d53b988648a31

SHA256
dd71d5c9977663f044af5eeda705e8ea915da0dfe686d788bf1928018f4261bf

SHA512
6e324ca0b3276202bf22576c74159f05dd989f95a3253cd754d151c227433e96833afc25d06d6b1b92d86dc79e4c8d729084389013e350dd234b763893796f64

Download Submit
C:\Windows\SysWOW64\Remcos\system.exe

Filesize
469KB

MD5
cce8602cd68aaf435c7ce42721867662

SHA1
6adbaa34a641b06b7580191f5dd24c1e82aab6de

SHA256
6de3b5982be4aa09debda91604b1dbbec315f20acd900a96468653aaeab197a5

SHA512
ed5357cb5d8c8139b8e918d3b75914b2a8523c09df81d7976df4d4c1a411e16262b509459384bb8ea92b89e5de1d5a655464719800e0da67ff4668005ea063e9

Download Submit
memory/2628-17-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download
memory/2628-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-18-0x0000000000130000-0x00000000001AF000-memory.dmp

Filesize
508KB

Download
memory/2752-32-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-35-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-19-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-20-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-21-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-22-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-24-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-25-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-26-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-27-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-28-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-29-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-30-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-13-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-31-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-33-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-34-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-36-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-39-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-41-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-42-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-45-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-46-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-51-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-52-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-53-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-57-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-58-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-65-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-71-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-72-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-73-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-74-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-11-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download
memory/2752-12-0x0000000000120000-0x000000000019F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads