Overview

overview

10

Static

static

3

JaffaCakes...c5.exe

windows7-x64

10

JaffaCakes...c5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 19:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe

  • Size

    724KB

  • MD5

    9410ebc9117f41c269a8bec67d519ac5

  • SHA1

    94693c477ea06438126e046294a49505635042e3

  • SHA256

    9d91baef92f3e8415ddde9ed675f6c8d45eef04d7c43122ab3ccb68a767eb351

  • SHA512

    33925501857631e9431bad20603f6aeea453005cd82d1b1f37be3b6a60fbd0ffe38bef1cc00206991a4be6ffd992880d6258fd7e4dde89ceea9eb8bff0cc2cc9

  • SSDEEP

    12288:89z7lfMtrJxE7GpkLK1NnO9+kTblfRz0ltwLURJqtha1Do14a5U:89z7lpDYk9RstwIRJL1Do14a5

Score
10/10
blackshadeslatentbotdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

latentbot

C2

xpussyassshitfuckx.zapto.org

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 20 IoCs
  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot
  • Latentbot family
    latentbot
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4452
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9410ebc9117f41c269a8bec67d519ac5.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1856
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:5080
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\conhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\conhost.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:4664
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Users\Admin\AppData\Roaming\conhost.exe
      C:\Users\Admin\AppData\Roaming\conhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Users\Admin\AppData\Roaming\conhost.exe
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1236
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Roaming\conhost.exe
      C:\Users\Admin\AppData\Roaming\conhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Users\Admin\AppData\Roaming\conhost.exe
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3848
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Users\Admin\AppData\Roaming\conhost.exe
      C:\Users\Admin\AppData\Roaming\conhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Users\Admin\AppData\Roaming\conhost.exe
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3588
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:992
    • C:\Users\Admin\AppData\Roaming\conhost.exe
      C:\Users\Admin\AppData\Roaming\conhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1112
      • C:\Users\Admin\AppData\Roaming\conhost.exe
        "C:\Users\Admin\AppData\Roaming\conhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3496
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
    1⤵
      PID:2640
      • C:\Users\Admin\AppData\Roaming\conhost.exe
        C:\Users\Admin\AppData\Roaming\conhost.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        PID:628
        • C:\Users\Admin\AppData\Roaming\conhost.exe
          "C:\Users\Admin\AppData\Roaming\conhost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1184
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
      1⤵
        PID:4448
        • C:\Users\Admin\AppData\Roaming\conhost.exe
          C:\Users\Admin\AppData\Roaming\conhost.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2952
          • C:\Users\Admin\AppData\Roaming\conhost.exe
            "C:\Users\Admin\AppData\Roaming\conhost.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
        1⤵
          PID:4664
          • C:\Users\Admin\AppData\Roaming\conhost.exe
            C:\Users\Admin\AppData\Roaming\conhost.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:4868
            • C:\Users\Admin\AppData\Roaming\conhost.exe
              "C:\Users\Admin\AppData\Roaming\conhost.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1276
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
          1⤵
            PID:468
            • C:\Users\Admin\AppData\Roaming\conhost.exe
              C:\Users\Admin\AppData\Roaming\conhost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:1688
              • C:\Users\Admin\AppData\Roaming\conhost.exe
                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1608
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
            1⤵
              PID:2144
              • C:\Users\Admin\AppData\Roaming\conhost.exe
                C:\Users\Admin\AppData\Roaming\conhost.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:348
                • C:\Users\Admin\AppData\Roaming\conhost.exe
                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4996
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
              1⤵
                PID:3652
                • C:\Users\Admin\AppData\Roaming\conhost.exe
                  C:\Users\Admin\AppData\Roaming\conhost.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:3540
                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2880
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                1⤵
                  PID:1112
                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                    C:\Users\Admin\AppData\Roaming\conhost.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:4496
                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:668
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                  1⤵
                    PID:1168
                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                      C:\Users\Admin\AppData\Roaming\conhost.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of SetWindowsHookEx
                      PID:888
                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:5116
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                    1⤵
                      PID:4184
                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                        C:\Users\Admin\AppData\Roaming\conhost.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:3840
                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1832
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                      1⤵
                        PID:2376
                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                          C:\Users\Admin\AppData\Roaming\conhost.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:2928
                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4560
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                        1⤵
                          PID:2656
                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                            C:\Users\Admin\AppData\Roaming\conhost.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3120
                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:4176
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                          1⤵
                            PID:4504
                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                              C:\Users\Admin\AppData\Roaming\conhost.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of SetWindowsHookEx
                              PID:4940
                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4368
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                            1⤵
                              PID:2104
                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of SetWindowsHookEx
                                PID:4520
                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1392
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                              1⤵
                                PID:4664
                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2984
                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4288
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                1⤵
                                  PID:2276
                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1192
                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4064
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                  1⤵
                                    PID:4832
                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4856
                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4912
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                    1⤵
                                      PID:3840
                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:1972
                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:2420
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                      1⤵
                                        PID:2928
                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:2052
                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4156
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                        1⤵
                                          PID:2400
                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2156
                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1872
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                          1⤵
                                            PID:4576
                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:4044
                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                PID:4252
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                            1⤵
                                              PID:1152
                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:2564
                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3928
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                              1⤵
                                                PID:2552
                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:4384
                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:3752
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                1⤵
                                                  PID:4416
                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:3340
                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:784
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                  1⤵
                                                    PID:4476
                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4660
                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:4480
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                    1⤵
                                                      PID:3648
                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4572
                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4832
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                      1⤵
                                                        PID:4692
                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3380
                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:2248
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                        1⤵
                                                          PID:3980
                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:1388
                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:2876
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                          1⤵
                                                            PID:3300
                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4532
                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4192
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                            1⤵
                                                              PID:3960
                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                2⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:3172
                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                  3⤵
                                                                    PID:2764
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                1⤵
                                                                  PID:3180
                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                    2⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2708
                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                      3⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3792
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                  1⤵
                                                                    PID:4084
                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                      2⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4584
                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                        3⤵
                                                                          PID:824
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                      1⤵
                                                                        PID:2376
                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                          2⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:632
                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                            3⤵
                                                                              PID:348
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                          1⤵
                                                                            PID:2372
                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                              2⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:556
                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4048
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                            1⤵
                                                                              PID:3432
                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                2⤵
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2276
                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                  3⤵
                                                                                    PID:4144
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                1⤵
                                                                                  PID:3220
                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                    2⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:548
                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                      3⤵
                                                                                        PID:2572
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                    1⤵
                                                                                      PID:448
                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                        2⤵
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3788
                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                          3⤵
                                                                                            PID:2348
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                        1⤵
                                                                                          PID:3840
                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                            2⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            PID:2256
                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                              3⤵
                                                                                                PID:624
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                            1⤵
                                                                                              PID:4192
                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                2⤵
                                                                                                • Suspicious use of SetThreadContext
                                                                                                PID:2928
                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                  3⤵
                                                                                                    PID:5052
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                1⤵
                                                                                                  PID:4688
                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                    2⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2084
                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                      3⤵
                                                                                                        PID:516
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                    1⤵
                                                                                                      PID:372
                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                        2⤵
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        PID:3248
                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                          3⤵
                                                                                                            PID:4580
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                        1⤵
                                                                                                          PID:824
                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                            2⤵
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1540
                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                              3⤵
                                                                                                                PID:952
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                            1⤵
                                                                                                              PID:4904
                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                2⤵
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3384
                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                  3⤵
                                                                                                                    PID:1416
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                1⤵
                                                                                                                  PID:3432
                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1904
                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                      3⤵
                                                                                                                        PID:1768
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                    1⤵
                                                                                                                      PID:4568
                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                        2⤵
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:1344
                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:548
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                      1⤵
                                                                                                                        PID:432
                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:1940
                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                            3⤵
                                                                                                                              PID:3740
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                          1⤵
                                                                                                                            PID:1160
                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:2200
                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                3⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2612
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                            1⤵
                                                                                                                              PID:624
                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                PID:3120
                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:4720
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4328
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:5104
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:320
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:4844
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:4740
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3900
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:2740
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                          2⤵
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          PID:4660
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3128
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:992
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3664
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:888
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:1544
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2404
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1840
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4716
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    PID:3572
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4444
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:824
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      PID:5016
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4692
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4836
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:3476
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4148
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4440
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:3820
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1940
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2708
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4464
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3608
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1152
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:2436
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:748
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:624
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3340
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1476
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3580
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4084
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4660
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4664
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3780
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2704
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4724
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3556
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2404
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3308
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3480
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4252
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:532
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:824
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3956
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3432
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1516
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5008
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4820
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3440
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:1760
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3604
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:624
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:116
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4692
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1192
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:3540
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3584
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3856
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3960
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3976
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2368
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3980
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:2416
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:4616
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\conhost.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:632

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\conhost.exe
                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    724KB

                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                    9410ebc9117f41c269a8bec67d519ac5

                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                    94693c477ea06438126e046294a49505635042e3

                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                    9d91baef92f3e8415ddde9ed675f6c8d45eef04d7c43122ab3ccb68a767eb351

                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                    33925501857631e9431bad20603f6aeea453005cd82d1b1f37be3b6a60fbd0ffe38bef1cc00206991a4be6ffd992880d6258fd7e4dde89ceea9eb8bff0cc2cc9

                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                  • memory/668-148-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1184-78-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1236-35-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1276-106-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1608-104-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/1832-175-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/2880-128-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-2-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-11-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-82-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-12-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-4-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3424-152-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3496-58-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3588-56-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/3848-36-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4560-173-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4648-80-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/4996-125-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                  • memory/5116-150-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                    Download