Overview

overview

10

Static

static

10

JaffaCakes...a3.exe

windows7-x64

8

JaffaCakes...a3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 20:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe

  • Size

    164KB

  • MD5

    979f3b58bfb137b9365415fb33d7aaa3

  • SHA1

    a6976909a55c4f90313a657efe05bab1dbe61b58

  • SHA256

    aa8de0c2cc4b1a9ad64f59136d189bb8b914cfe01e04b09b73743ba729a2afb8

  • SHA512

    51ddf24af2edb18b2ed55ed53cd2edd507600c642d5906168b247366b42b6a73a055789854252bad690dfb0f753136e018158ddcc55ac42c7f87affb82e653bc

  • SSDEEP

    3072:nGbjlUV7Xbs5gwRBr8TbA69YtyxOrh8ZBipCpvAw88AsntWXTSlCXQ9VGLDFG4FW:olUV0gaBAbA69YtWOrDpsNWmtWjSXGVj

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 64 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 56 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4972
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_979f3b58bfb137b9365415fb33d7aaa3.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2784
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:688
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:672
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2576
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4644
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4160
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3080
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2984
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3024
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:224
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2976
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1656
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3948
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3880
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4940
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1048
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2900
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1348
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2424
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
      PID:2704
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        C:\Users\Admin\AppData\Roaming\svchost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4840
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
        PID:4880
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          C:\Users\Admin\AppData\Roaming\svchost.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
        1⤵
          PID:4780
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            C:\Users\Admin\AppData\Roaming\svchost.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2776
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
          1⤵
            PID:4464
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3408
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
              PID:2828
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2640
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
              1⤵
                PID:4572
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  C:\Users\Admin\AppData\Roaming\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1788
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                1⤵
                  PID:4612
                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                    C:\Users\Admin\AppData\Roaming\svchost.exe
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4020
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                  1⤵
                    PID:3896
                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                      C:\Users\Admin\AppData\Roaming\svchost.exe
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3188
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                    1⤵
                      PID:4880
                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                        C:\Users\Admin\AppData\Roaming\svchost.exe
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3360
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                      1⤵
                        PID:1716
                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                          C:\Users\Admin\AppData\Roaming\svchost.exe
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:4584
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                        1⤵
                          PID:2828
                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            C:\Users\Admin\AppData\Roaming\svchost.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:3504
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                          1⤵
                            PID:532
                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                              C:\Users\Admin\AppData\Roaming\svchost.exe
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:636
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                            1⤵
                              PID:2800
                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:4776
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                              1⤵
                                PID:936
                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3508
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                1⤵
                                  PID:1512
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4940
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                  1⤵
                                    PID:2560
                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2284
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                    1⤵
                                      PID:4596
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4972
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                      1⤵
                                        PID:1056
                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1276
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                        1⤵
                                          PID:448
                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:4996
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                          1⤵
                                            PID:3852
                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1028
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                            1⤵
                                              PID:4024
                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:1572
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                              1⤵
                                                PID:4528
                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2272
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                1⤵
                                                  PID:1052
                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4428
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  1⤵
                                                    PID:3596
                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4600
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    1⤵
                                                      PID:3188
                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4904
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      1⤵
                                                        PID:2204
                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2432
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        1⤵
                                                          PID:4940
                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3452
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          1⤵
                                                            PID:4964
                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2208
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            1⤵
                                                              PID:940
                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:448
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              1⤵
                                                                PID:2580
                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4728
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                1⤵
                                                                  PID:920
                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4848
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  1⤵
                                                                    PID:2804
                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1048
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    1⤵
                                                                      PID:3396
                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3588
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      1⤵
                                                                        PID:4388
                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1668
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        1⤵
                                                                          PID:2936
                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4404
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          1⤵
                                                                            PID:4836
                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1656
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            1⤵
                                                                              PID:2000
                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3600
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              1⤵
                                                                                PID:688
                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2204
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                1⤵
                                                                                  PID:4924
                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1120
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  1⤵
                                                                                    PID:3832
                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3624
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    1⤵
                                                                                      PID:1036
                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4660
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      1⤵
                                                                                        PID:1336
                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:752
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        1⤵
                                                                                          PID:4480
                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            2⤵
                                                                                              PID:3904
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            1⤵
                                                                                              PID:4264
                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                2⤵
                                                                                                  PID:4752
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                1⤵
                                                                                                  PID:3584
                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    2⤵
                                                                                                      PID:4608
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    1⤵
                                                                                                      PID:3748
                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        2⤵
                                                                                                          PID:1048
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        1⤵
                                                                                                          PID:2648
                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            2⤵
                                                                                                              PID:3588
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            1⤵
                                                                                                              PID:376
                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                2⤵
                                                                                                                  PID:532
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                1⤵
                                                                                                                  PID:456
                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    2⤵
                                                                                                                      PID:4824
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    1⤵
                                                                                                                      PID:636
                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        2⤵
                                                                                                                          PID:4404
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        1⤵
                                                                                                                          PID:4764
                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            2⤵
                                                                                                                              PID:2000
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            1⤵
                                                                                                                              PID:2360
                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                2⤵
                                                                                                                                  PID:4672
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                1⤵
                                                                                                                                  PID:320
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:4880
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:852
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:700
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:3148
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:1488
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:3832
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:752
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4964
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2532
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:512
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3852
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2436
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5036
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3672
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3880
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1376
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1112
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4208
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2820
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4388
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1224
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3896
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1808
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4668
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:1632
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2212
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3600
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1508
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3476
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:672
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:3148
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1456

                                                                                                                                                                                                              Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                164KB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                979f3b58bfb137b9365415fb33d7aaa3

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                a6976909a55c4f90313a657efe05bab1dbe61b58

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                aa8de0c2cc4b1a9ad64f59136d189bb8b914cfe01e04b09b73743ba729a2afb8

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                51ddf24af2edb18b2ed55ed53cd2edd507600c642d5906168b247366b42b6a73a055789854252bad690dfb0f753136e018158ddcc55ac42c7f87affb82e653bc

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • memory/224-50-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/448-337-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/532-472-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/636-200-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/672-629-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/700-510-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/752-522-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/752-424-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1028-257-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1048-458-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1048-93-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1048-351-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1112-565-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1120-412-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1224-579-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1276-245-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1348-112-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1456-630-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1488-524-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1508-604-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1572-274-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1572-278-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1656-66-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1656-381-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1656-58-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1668-368-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1788-157-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/1808-578-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2000-498-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2204-394-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2208-323-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2212-591-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2272-276-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2272-273-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2284-226-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2424-110-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2432-305-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2532-540-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2640-155-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2776-139-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2820-567-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2900-95-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2976-65-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/2984-31-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3024-52-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3080-33-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3188-171-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3360-183-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3360-176-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3408-137-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3452-321-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3504-198-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3508-213-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3588-470-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3588-367-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3600-393-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3624-410-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3696-618-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3852-539-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3880-551-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3880-72-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3880-81-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3904-440-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/3948-79-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4020-169-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4160-20-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4160-14-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4404-484-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4404-380-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4428-291-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4584-181-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4600-293-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4608-456-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4644-19-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4660-426-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4660-616-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4668-590-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4672-500-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4728-335-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4752-437-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4752-441-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4776-214-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4824-485-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4840-124-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4848-350-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4852-606-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4880-512-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4884-125-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4904-306-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4940-228-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4972-243-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/4996-259-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-0-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-36-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-23-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-96-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-141-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-307-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-184-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-395-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-265-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5012-352-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download

                                                                                                                                                                                                              • memory/5036-552-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                460KB

                                                                                                                                                                                                                Download