Overview

overview

10

Static

static

3

JaffaCakes...3f.exe

windows7-x64

10

JaffaCakes...3f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 19:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9910fa29b8f629fef294a96faacb9d3f.exe

  • Size

    1.6MB

  • MD5

    9910fa29b8f629fef294a96faacb9d3f

  • SHA1

    39fef68135b3e264bbf5e772f77f3d597f68a1b4

  • SHA256

    9a9867db74c4f73b05f9846aa61d8216b50c280f71abc28bf05a7c4cf1df07ed

  • SHA512

    5e9c48961ab2f04ad8e8707d2806673500b01a2b9f4388372116afbc0c3f4dddb51e0bc949fb473e8ae7aebd5514417a9c042c99c83c60fce1ad5d0080f17861

  • SSDEEP

    49152:kt586pw9pIf4QzpbdmpXm3Qx2RzevU9NQ85T/:giSr1z3cWAx2RzKgm85/

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 64 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9910fa29b8f629fef294a96faacb9d3f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9910fa29b8f629fef294a96faacb9d3f.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6056
    • C:\Users\Admin\AppData\Local\Temp\tmp1.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\tmp1.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp1.exe"
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
            PID:2960
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • Modifies firewall policy service
              • Modifies registry key
              PID:1692
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\tmp1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\tmp1.exe:*:Enabled:Windows Messanger" /f
            4⤵
              PID:3816
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\tmp1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\tmp1.exe:*:Enabled:Windows Messanger" /f
                5⤵
                • Modifies firewall policy service
                • Modifies registry key
                PID:5196
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              4⤵
                PID:2232
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                  5⤵
                  • Modifies firewall policy service
                  • Modifies registry key
                  PID:3432
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
                4⤵
                  PID:4456
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
                    5⤵
                    • Modifies firewall policy service
                    • Modifies registry key
                    PID:5860
            • C:\Users\Admin\AppData\Local\Temp\tmp2.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp2.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3232
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4016
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1720
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:840
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2928
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5580
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2448
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2180
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1300
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:5800
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1680
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5876
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
              PID:404
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3776
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  C:\Users\Admin\AppData\Roaming\svchost.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5384
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
              1⤵
                PID:1400
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  C:\Users\Admin\AppData\Roaming\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1948
                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                    C:\Users\Admin\AppData\Roaming\svchost.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4056
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                1⤵
                  PID:1588
                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                    C:\Users\Admin\AppData\Roaming\svchost.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1228
                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                      C:\Users\Admin\AppData\Roaming\svchost.exe
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4884
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                  1⤵
                    PID:4980
                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                      C:\Users\Admin\AppData\Roaming\svchost.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:5668
                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                        C:\Users\Admin\AppData\Roaming\svchost.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:5508
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                    1⤵
                      PID:4988
                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                        C:\Users\Admin\AppData\Roaming\svchost.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1748
                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                          C:\Users\Admin\AppData\Roaming\svchost.exe
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3068
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                      1⤵
                        PID:4992
                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                          C:\Users\Admin\AppData\Roaming\svchost.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:5924
                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            C:\Users\Admin\AppData\Roaming\svchost.exe
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4956
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                        1⤵
                          PID:1852
                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            C:\Users\Admin\AppData\Roaming\svchost.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3296
                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                              C:\Users\Admin\AppData\Roaming\svchost.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1036
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                          1⤵
                            PID:5676
                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                              C:\Users\Admin\AppData\Roaming\svchost.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4848
                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:228
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                            1⤵
                              PID:4548
                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:1392
                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:6052
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                              1⤵
                                PID:4712
                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:5744
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4624
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                1⤵
                                  PID:4544
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:1512
                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:896
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                  1⤵
                                    PID:2100
                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2336
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:928
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                    1⤵
                                      PID:5104
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:3680
                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2384
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                      1⤵
                                        PID:1208
                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:1612
                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2176
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                        1⤵
                                          PID:6000
                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:3236
                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1388
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                          1⤵
                                            PID:5284
                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:1928
                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:844
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                            1⤵
                                              PID:5288
                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                PID:3228
                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4936
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                              1⤵
                                                PID:3168
                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:2440
                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3032
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                1⤵
                                                  PID:5788
                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4480
                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:5676
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  1⤵
                                                    PID:2904
                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:564
                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3844
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    1⤵
                                                      PID:1480
                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:2116
                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2880
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      1⤵
                                                        PID:2396
                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:5132
                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5156
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        1⤵
                                                          PID:4240
                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1512
                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2328
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          1⤵
                                                            PID:4680
                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4616
                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3900
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            1⤵
                                                              PID:5636
                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:5328
                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5192
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              1⤵
                                                                PID:5896
                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:5912
                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:5180
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                1⤵
                                                                  PID:5748
                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    2⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:4744
                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      3⤵
                                                                        PID:1984
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    1⤵
                                                                      PID:3592
                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:1228
                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          3⤵
                                                                            PID:3228
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        1⤵
                                                                          PID:1624
                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            2⤵
                                                                            • Suspicious use of SetThreadContext
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4992
                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2172
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          1⤵
                                                                            PID:3028
                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              2⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5060
                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                3⤵
                                                                                  PID:4488
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              1⤵
                                                                                PID:5788
                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  2⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:2580
                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    3⤵
                                                                                      PID:4484
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  1⤵
                                                                                    PID:4848
                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      2⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:3960
                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        3⤵
                                                                                          PID:5888
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      1⤵
                                                                                        PID:1708
                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          2⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:6052
                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            3⤵
                                                                                              PID:3400
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          1⤵
                                                                                            PID:5808
                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              2⤵
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:5412
                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2728
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            1⤵
                                                                                              PID:5080
                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                2⤵
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4812
                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4964
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              1⤵
                                                                                                PID:4988
                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  2⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:5920
                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    3⤵
                                                                                                      PID:1864
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  1⤵
                                                                                                    PID:4616
                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      2⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:1788
                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        3⤵
                                                                                                          PID:3188
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      1⤵
                                                                                                        PID:4172
                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                          2⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          PID:3324
                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1004
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        1⤵
                                                                                                          PID:5028
                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            2⤵
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            PID:2700
                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              3⤵
                                                                                                                PID:3872
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            1⤵
                                                                                                              PID:5492
                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                2⤵
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:4748
                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5660
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              1⤵
                                                                                                                PID:5104
                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  2⤵
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4044
                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    3⤵
                                                                                                                      PID:3728
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  1⤵
                                                                                                                    PID:4016
                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                      2⤵
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      PID:2064
                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:656
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    1⤵
                                                                                                                      PID:316
                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        2⤵
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:2360
                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:976
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                      1⤵
                                                                                                                        PID:3208
                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          PID:4868
                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2312
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        1⤵
                                                                                                                          PID:2032
                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            2⤵
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            PID:228
                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                              3⤵
                                                                                                                                PID:4704
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            1⤵
                                                                                                                              PID:1256
                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4344
                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  3⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3960
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                              1⤵
                                                                                                                                PID:4848
                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  PID:4500
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    3⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2396
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                1⤵
                                                                                                                                  PID:564
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    PID:868
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      3⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4312
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4968
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      PID:5420
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:4812
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1352
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                          2⤵
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          PID:1420
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:1496
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:4068
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4116
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:5984
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:6008
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                2⤵
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                PID:1652
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2400
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:3440
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    PID:2744
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      3⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4072
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1788
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      PID:896
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3896
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3264
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:3432
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3984
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6140
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:3680
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5520
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3396
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  PID:4744
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1980
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2512
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      PID:2840
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1588
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1472
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2608
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5372
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4432
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3724
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4708
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3296
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4940
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4568
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4480
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4732
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4344
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5900
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5352
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:232
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4400
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3352
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5820
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1392
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2788
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2308
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:1944
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5904
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4944
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5596
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2208
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:1868
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2228
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:6044
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1012
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4828
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1360
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1592
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:6092
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1488
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:5996
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:5132

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp1.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              217KB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              3bbd4585baaf29b976455cb2d27cea8c

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              6de8c5727908c2a302851f46d8ce15b3d2559bf9

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              9d27c98acae09233dd8c7b895501a561d1b07e8926ff224950dde021a0111e69

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              068f3afa82422953b286f4327430ae45f3b5d8fec4c729186cf132bc9d06b904521163c9be97221bc3d2da7e505e7a3b83f58957c00742adae55e9bb37615199

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp2.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              a4a35c295f029ae2b5a8d5bb50e1f66d

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              4d4afc22493230a2e7f2a2403681e4307f235ad9

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              1d069f565744fd229e5f729616f5c952c0b10e88c8b90d0e0ad017deea91d6d8

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              f55e0a3f2918f0465a2834af263f5b267b4626c70cac460de11e736ac60e74dd9e610364e2107572b72ef3c62162baecfe82b473dd7d8f0d2e20ba344f50bbb0

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp3.exe
                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              8B

                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                              9d8ac3bf6e084e550092d29e52c14ff1

                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                              2c32eadcd9ebdfb6ac930b85dad07d949a6c2c2d

                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                              bc0ae492ebb0a6ddf1a3a28488b2f3e43606c60e4fe7958188ecdf14acd7ca66

                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                              f86a061e45c859622bdd32f2d62243e9e2fe4088059434468bd55bafab81279704add4d0239a1eb65667ed4aa0c19f5cbd004953eeb0cd39c5f2422e89750e8d

                                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                                            • memory/228-202-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/232-911-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/656-648-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/844-311-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/844-308-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/896-267-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/928-253-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/976-662-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1004-601-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1036-215-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1300-105-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1388-323-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1496-744-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-40-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-83-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-39-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-164-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-38-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1568-34-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1588-835-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1720-79-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1720-76-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1864-577-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1944-938-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1980-838-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1980-833-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/1984-482-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2172-506-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2172-500-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2176-284-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2312-673-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2328-420-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2384-296-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2396-711-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2396-709-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2400-753-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2400-762-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2728-545-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2880-393-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2880-390-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2884-958-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/2884-961-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3032-349-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3068-188-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3188-598-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3188-603-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3228-471-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3228-468-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3232-51-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              176KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3232-31-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              176KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3232-55-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              176KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3400-555-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3728-645-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3844-378-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3872-612-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3872-615-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3896-790-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3900-432-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3960-692-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/3984-811-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4056-122-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4072-792-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4312-722-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4344-889-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4344-883-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4484-527-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4484-533-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4488-497-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4488-491-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4568-886-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4568-882-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4624-228-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4704-695-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4708-865-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4708-860-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4812-734-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4884-160-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4936-337-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4956-176-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/4964-566-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5080-924-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5080-928-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5156-406-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5156-403-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5180-459-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5192-447-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5372-858-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5372-863-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5384-143-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5508-144-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5508-148-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5520-812-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5520-815-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5580-70-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5580-64-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5660-626-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5676-366-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5820-899-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5876-96-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5888-531-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5904-949-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/5984-767-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                            • memory/6052-241-0x0000000000400000-0x0000000000473000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              460KB

                                                                                                                                                                                                                                                              Download