modiloader | 32e7012c274784d1837bc9b77430d28067d95fcdee5884d1f23a9fc373a89e00

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe
Size

293KB
MD5

95d8f2ce6cd34a7189085298c5b7c602
SHA1

a00a8d17bcd095bcd412ee4498fe1132a13478c1
SHA256

32e7012c274784d1837bc9b77430d28067d95fcdee5884d1f23a9fc373a89e00
SHA512

9e597be36cbb4186141b1ccc7b87b5aea6cb0dcb16a2a656f41814e20e441812b5b5225403ca8a1962b074703d2f532732068230b0bff02972a9c93f161317da
SSDEEP

6144:HY/XgvZX4NeCpyzStZ32QUf0b3MgZmpPpO:+I4NhdGDq8gopRO

Score

10^/10

modiloader discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = ",C:\\Windows\\svchosts.exe"	svchosts.exe

Modiloader family
modiloader

ModiLoader Second Stage 64 IoCs

resource	yara_rule
behavioral2/memory/1752-26-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3864-32-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2936-33-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3864-29-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1164-35-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1164-37-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3232-41-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4632-44-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3188-48-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2712-50-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1780-53-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1080-55-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1080-57-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/448-59-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1540-60-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/228-63-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1904-66-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2148-69-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1200-72-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3988-75-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3704-78-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4996-81-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2940-86-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1468-85-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2940-88-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1040-91-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4352-94-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4408-99-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4984-97-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4984-101-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/5100-104-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4700-109-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4764-108-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4700-111-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/916-113-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/916-115-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1036-118-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1968-121-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2452-124-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1240-127-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1316-129-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1240-131-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1636-134-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4992-136-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4992-139-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1588-141-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/2812-144-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3540-147-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4684-153-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1752-151-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3656-156-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4764-162-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4988-165-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1592-167-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/5100-159-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1592-169-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4212-172-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/1080-174-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4156-180-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/5008-182-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/5008-178-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/3144-186-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4948-187-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2
behavioral2/memory/4948-188-0x0000000030000000-0x0000000030039000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe

Executes dropped EXE 16 IoCs

pid	Process
1752	svchost.exe
448	svchosts.exe
2936	svchosts.exe
3864	svchosts.exe
1164	svchosts.exe
3232	svchosts.exe
4632	svchosts.exe
3188	svchosts.exe
2712	svchosts.exe
1780	svchosts.exe
1080	svchosts.exe
1540	svchosts.exe
228	svchosts.exe
1904	svchosts.exe
2148	svchosts.exe
1200	svchosts.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\svchosts.exe"	svchosts.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe
File created	C:\Windows\SysWOW64\tmp.htm	svchosts.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000024207-13.dat	upx
behavioral2/memory/1752-16-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1752-26-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/448-25-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3864-32-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2936-33-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3864-29-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1164-35-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1164-37-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3232-39-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3232-41-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4632-44-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3188-46-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3188-48-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2712-50-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1780-53-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1080-55-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1080-57-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/448-59-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1540-60-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/228-63-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1904-66-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2148-69-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1200-72-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3988-75-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3704-78-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4996-81-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2940-86-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1468-85-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2940-88-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1040-91-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4352-94-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4408-99-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4984-97-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4984-101-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/5100-104-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4700-109-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4764-108-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4700-111-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/916-113-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/916-115-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1036-118-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1968-121-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2452-124-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1240-127-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1316-129-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1240-131-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1636-134-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4992-136-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4992-139-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1588-141-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/2812-144-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3540-147-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4684-153-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1752-151-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/3656-156-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4764-162-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4988-165-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1592-167-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/5100-159-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1592-169-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4212-172-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/1080-174-0x0000000030000000-0x0000000030039000-memory.dmp	upx
behavioral2/memory/4156-180-0x0000000030000000-0x0000000030039000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchosts.exe	svchost.exe
File opened for modification	C:\Windows\svchosts.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosts.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
448	svchosts.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
448	svchosts.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1752	2180	JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe	89
PID 2180 wrote to memory of 1752	2180	JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe	89
PID 2180 wrote to memory of 1752	2180	JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe	89
PID 1752 wrote to memory of 448	1752	svchost.exe	90
PID 1752 wrote to memory of 448	1752	svchost.exe	90
PID 1752 wrote to memory of 448	1752	svchost.exe	90
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 448 wrote to memory of 3404	448	svchosts.exe	55
PID 1040 wrote to memory of 2936	1040	cmd.exe	151
PID 1040 wrote to memory of 2936	1040	cmd.exe	151
PID 1040 wrote to memory of 2936	1040	cmd.exe	151
PID 3392 wrote to memory of 3864	3392	cmd.exe	96
PID 3392 wrote to memory of 3864	3392	cmd.exe	96
PID 3392 wrote to memory of 3864	3392	cmd.exe	96
PID 4724 wrote to memory of 1164	4724	cmd.exe	101
PID 4724 wrote to memory of 1164	4724	cmd.exe	101
PID 4724 wrote to memory of 1164	4724	cmd.exe	101
PID 2316 wrote to memory of 3232	2316	cmd.exe	104
PID 2316 wrote to memory of 3232	2316	cmd.exe	104
PID 2316 wrote to memory of 3232	2316	cmd.exe	104
PID 984 wrote to memory of 4632	984	cmd.exe	607
PID 984 wrote to memory of 4632	984	cmd.exe	607
PID 984 wrote to memory of 4632	984	cmd.exe	607
PID 2640 wrote to memory of 3188	2640	cmd.exe	110
PID 2640 wrote to memory of 3188	2640	cmd.exe	110
PID 2640 wrote to memory of 3188	2640	cmd.exe	110
PID 3752 wrote to memory of 2712	3752	cmd.exe	113
PID 3752 wrote to memory of 2712	3752	cmd.exe	113
PID 3752 wrote to memory of 2712	3752	cmd.exe	113
PID 3568 wrote to memory of 1780	3568	cmd.exe	305
PID 3568 wrote to memory of 1780	3568	cmd.exe	305
PID 3568 wrote to memory of 1780	3568	cmd.exe	305
PID 3124 wrote to memory of 1080	3124	cmd.exe	1571
PID 3124 wrote to memory of 1080	3124	cmd.exe	1571
PID 3124 wrote to memory of 1080	3124	cmd.exe	1571
PID 1968 wrote to memory of 1540	1968	cmd.exe	420
PID 1968 wrote to memory of 1540	1968	cmd.exe	420
PID 1968 wrote to memory of 1540	1968	cmd.exe	420
PID 856 wrote to memory of 228	856	cmd.exe	2442
PID 856 wrote to memory of 228	856	cmd.exe	2442
PID 856 wrote to memory of 228	856	cmd.exe	2442
PID 3172 wrote to memory of 1904	3172	cmd.exe	1669
PID 3172 wrote to memory of 1904	3172	cmd.exe	1669
PID 3172 wrote to memory of 1904	3172	cmd.exe	1669
PID 1048 wrote to memory of 2148	1048	cmd.exe	131
PID 1048 wrote to memory of 2148	1048	cmd.exe	131
PID 1048 wrote to memory of 2148	1048	cmd.exe	131
PID 5012 wrote to memory of 1200	5012	cmd.exe	4554
PID 5012 wrote to memory of 1200	5012	cmd.exe	4554
PID 5012 wrote to memory of 1200	5012	cmd.exe	4554

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d8f2ce6cd34a7189085298c5b7c602.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\svchosts.exe
      -bs
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3524
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4216
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5028
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3384
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2668
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4148
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2936
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5092
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1292
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:924
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4632
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4108
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1072
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3808
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3276
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5032
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1740
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:404
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2832
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3344
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1584
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2996
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1496
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1056
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4256
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:824
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3112
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1140
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:948
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:228
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4064
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3276
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4572
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4228
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3636
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3344
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:720
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4744
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4108
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1992
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3400
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1520
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3212
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3500
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2416
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4232
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1904
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5028
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1780
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3172
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3664
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1612
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2948
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4840
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2816
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3632
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4100
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1068
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3124
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2808
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1992
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1576
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3212
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4552
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5068
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1708
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2820
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:184
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5028
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4572
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5116
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4668
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5100
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1060
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1460
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2624
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4116
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2596
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1664
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4408
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4360
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2640
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3784
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3508
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:872
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1008
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4192
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3456
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:828
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3580
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4208
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1396
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3500
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4036
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4780
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4348
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3112
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3732
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1696
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4700
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2744
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1240
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4256
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3400
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2180
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4888
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1316
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4992
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4512
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5032
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5052
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3552
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:408
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3988
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2112
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2132
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:184
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3148
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1032
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4100
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2840
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1312
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:404
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4784
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:228
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2628
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3124
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1696
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4088
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2744
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4764
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3240
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4672
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4668
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5024
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2316
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4544
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3704
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4232
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1828
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2272
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4852
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4492
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1728
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1080
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3172
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3664
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1200
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4560
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:372
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1708
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1424
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4360
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1992
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2756
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1904
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3972
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1316
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3240
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4940
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3196
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:232
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3452
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4100
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3508
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1804
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4188
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4772
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5104
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2360
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1140
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1636
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4552
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:972
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4036
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2840
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4496
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:924
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3972
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1868
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4100
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3772
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4336
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4668
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2164
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3732
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2296
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3636
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4720
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5068
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3400
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4744
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4608
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2112
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3876
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2880
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2516
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4772
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4652
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1828
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4728
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3772
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4740
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4088
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3648
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2636
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5008
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3344
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4440
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2640
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4124
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3664
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4336
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4500
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4396
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4256
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:720
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1056
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1584
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4784
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1708
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4992
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1424
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4940
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2936
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4120
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1588
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:404
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1040
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2520
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:904
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4156
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1392
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3732
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1316
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4800
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4404
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:528
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4604
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1468
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2192
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2640
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4744
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3456
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2832
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2244
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:184
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5012
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:612
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4408
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1448
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2756
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4888
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4632
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5096
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4500
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4396
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2948
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4576
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4672
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2504
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4976
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1588
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4044
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4800
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3708
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2676
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4608
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4512
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4740
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4632
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1040
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5104
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1692
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2756
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4924
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2472
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1468
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2996
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4404
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3056
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2164
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1588
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2936
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:388
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3932
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1492
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2820
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3000
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4608
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2760
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2828
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5076
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4884
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:956
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4236
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3784
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4888
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4924
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4840
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:872
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1180
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4200
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4156
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2008
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4632
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4128
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4852
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:400
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5184
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5200
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5220
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5304
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5328
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5544
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5628
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5784
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5876
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5952
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6056
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6092
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5008
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3000
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5260
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2564
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:724
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4788
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4556
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4604
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5524
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4764
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5608
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3864
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5540
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2628
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2748
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5884
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4988
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4684
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3580
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1464
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2132
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4772
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5716
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3984
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5344
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1588
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5872
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4104
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5752
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5628
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2828
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5912
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2908
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5800
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3216
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6036
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6080
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6064
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3916
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3172
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4000
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2244
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5432
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5328
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4512
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3948
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5484
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5572
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:388
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5536
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5884
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5564
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4780
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5708
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3568
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5288
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5012
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1056
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1932
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1584
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5208
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2812
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5204
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1472
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3644
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4140
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3124
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5668
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5740
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5608
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2204
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6000
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5300
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1148
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1968
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1080
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:216
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4660
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3640
- - C:\Windows\svchosts.exe
    C:\Windows\svchosts.exe
    3⤵
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:3704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\svchosts.exe
  2⤵
  PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
81KB

MD5
a0d693d09312b0f303d0ddb8eb855a16

SHA1
258ba24c945fc8c28a9e557289f06eb277549ef8

SHA256
f402eb39de2d7b7898b4514f903bae8da5b921f63b97f21448671b6931188df9

SHA512
44744bfde05fae31e9ec1cd90ec755b39a5f3fd3208292617eaaa27216e191790783442e59883580bedce5e8f8ca95792b92491880ede5677819c4f580fd5798

Download Submit
memory/228-63-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/380-214-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/380-211-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/392-219-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/448-25-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/448-59-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/824-225-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/916-113-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/916-115-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/984-234-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1036-118-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1040-91-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1080-174-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1080-55-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1080-57-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1164-37-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1164-35-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1200-72-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1240-131-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1240-127-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1316-129-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1448-196-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1448-200-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1468-85-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1540-60-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1588-141-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1592-169-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1592-167-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1636-134-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1752-151-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1752-16-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1752-26-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1780-53-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1832-229-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1904-66-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/1968-121-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2148-69-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2180-3-0x000000001B620000-0x000000001BAEE000-memory.dmp

Filesize
4.8MB

Download
memory/2180-2-0x00007FFC720F0000-0x00007FFC72A91000-memory.dmp

Filesize
9.6MB

Download
memory/2180-0-0x00007FFC723A5000-0x00007FFC723A6000-memory.dmp

Filesize
4KB

Download
memory/2180-4-0x000000001BC00000-0x000000001BC9C000-memory.dmp

Filesize
624KB

Download
memory/2180-5-0x00007FFC720F0000-0x00007FFC72A91000-memory.dmp

Filesize
9.6MB

Download
memory/2180-6-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/2180-7-0x000000001BD60000-0x000000001BDAC000-memory.dmp

Filesize
304KB

Download
memory/2180-9-0x00007FFC720F0000-0x00007FFC72A91000-memory.dmp

Filesize
9.6MB

Download
memory/2180-19-0x00007FFC720F0000-0x00007FFC72A91000-memory.dmp

Filesize
9.6MB

Download
memory/2180-1-0x000000001B0A0000-0x000000001B146000-memory.dmp

Filesize
664KB

Download
memory/2452-124-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2712-50-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2812-144-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2904-224-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2936-33-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2940-88-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/2940-86-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3144-186-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3188-48-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3188-46-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3232-39-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3232-41-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3492-215-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3492-217-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3540-147-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3656-156-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3704-78-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3732-198-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3864-29-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3864-32-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/3988-75-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4156-180-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4212-172-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4240-191-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4348-221-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4352-94-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4408-99-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4440-223-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4440-193-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4448-228-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4448-231-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4632-44-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4652-203-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4660-209-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4684-153-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4700-109-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4700-111-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4764-108-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4764-162-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4948-187-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4948-188-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4984-97-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4984-101-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4988-165-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4992-136-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4992-139-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/4996-81-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/5008-182-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/5008-178-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/5080-206-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/5100-159-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download
memory/5100-104-0x0000000030000000-0x0000000030039000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads