Overview

overview

10

Static

static

3

JaffaCakes...32.exe

windows7-x64

10

JaffaCakes...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2025, 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe

  • Size

    340KB

  • MD5

    996e057529b5c7f5a5967eb80ecabe32

  • SHA1

    1acf03131730d3ad618edde6888e42548195e1ca

  • SHA256

    889b75846fe4c693e2fda9740bfff552a8ee27382a6f8b012939e23a7abf334f

  • SHA512

    532fdf9bb18df8e43c54924f38221c9fad7cae333ab48ed081b3b2b0be4c0e814d8c153f6ac7914c756026e00dadfb2013277531a160c5f90146150b0f3d0e03

  • SSDEEP

    6144:OpNJjbYmuIpEAxUrGaWOqax3Yp6mbQf7YML+xZ2KEJ9TJ:OJj8mTpEAGp/2pkcHxQK

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerat

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 21 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4216
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5232
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_996e057529b5c7f5a5967eb80ecabe32.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1472
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WinDefender.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinDefender.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WinDefender.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinDefender.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1464
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
      C:\Users\Admin\AppData\Roaming\WinDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5292
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
      C:\Users\Admin\AppData\Roaming\WinDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5416
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
      C:\Users\Admin\AppData\Roaming\WinDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2044
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
      C:\Users\Admin\AppData\Roaming\WinDefender.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4252
      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5224
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
    1⤵
      PID:2744
      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
        C:\Users\Admin\AppData\Roaming\WinDefender.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2364
        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5868
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
      1⤵
        PID:5164
        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
          C:\Users\Admin\AppData\Roaming\WinDefender.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3228
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
        1⤵
          PID:1616
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            C:\Users\Admin\AppData\Roaming\WinDefender.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2072
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3656
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
            PID:5872
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:764
              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4428
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
            1⤵
              PID:4140
              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4988
                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1068
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
              1⤵
                PID:2172
                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:2288
                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4700
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                1⤵
                  PID:5928
                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:920
                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:856
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  1⤵
                    PID:540
                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2956
                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1800
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    1⤵
                      PID:5232
                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3180
                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3740
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      1⤵
                        PID:5064
                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of SetWindowsHookEx
                          PID:1224
                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:436
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        1⤵
                          PID:592
                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of SetWindowsHookEx
                            PID:1004
                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:5500
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          1⤵
                            PID:2068
                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:4504
                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:5288
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            1⤵
                              PID:5212
                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of SetWindowsHookEx
                                PID:5236
                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4536
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              1⤵
                                PID:880
                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4364
                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4540
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                1⤵
                                  PID:5316
                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6076
                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4248
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  1⤵
                                    PID:2648
                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of SetWindowsHookEx
                                      PID:6092
                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4880
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    1⤵
                                      PID:5420
                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:1700
                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5652
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      1⤵
                                        PID:1316
                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5240
                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:5256
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        1⤵
                                          PID:1244
                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2984
                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              PID:2492
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          1⤵
                                            PID:3208
                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:5436
                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                PID:216
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            1⤵
                                              PID:4576
                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:4504
                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:592
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              1⤵
                                                PID:3836
                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:5168
                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:3532
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                1⤵
                                                  PID:5572
                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:5612
                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:5280
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  1⤵
                                                    PID:1048
                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4204
                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3500
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    1⤵
                                                      PID:2828
                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4792
                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:3680
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      1⤵
                                                        PID:5780
                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5424
                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:3292
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        1⤵
                                                          PID:1820
                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:2688
                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:3952
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          1⤵
                                                            PID:2648
                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:4628
                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:3300
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            1⤵
                                                              PID:1316
                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                2⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:1828
                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                  3⤵
                                                                    PID:1908
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                1⤵
                                                                  PID:1096
                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    2⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:5268
                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                      3⤵
                                                                        PID:3568
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    1⤵
                                                                      PID:5088
                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                        2⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3940
                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4988
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      1⤵
                                                                        PID:4148
                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          2⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:6044
                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                            3⤵
                                                                              PID:2236
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          1⤵
                                                                            PID:3188
                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                              2⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:920
                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                3⤵
                                                                                  PID:3780
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                              1⤵
                                                                                PID:3924
                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                  2⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:2244
                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                    3⤵
                                                                                      PID:5320
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                  1⤵
                                                                                    PID:840
                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      2⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:4108
                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                        3⤵
                                                                                          PID:5436
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      1⤵
                                                                                        PID:1692
                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          2⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1416
                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2132
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                        1⤵
                                                                                          PID:4604
                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            2⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:852
                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                              3⤵
                                                                                                PID:3864
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            1⤵
                                                                                              PID:3100
                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                2⤵
                                                                                                • Suspicious use of SetThreadContext
                                                                                                PID:4912
                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3836
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                              1⤵
                                                                                                PID:2372
                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  2⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:3708
                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                    3⤵
                                                                                                      PID:5596
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  1⤵
                                                                                                    PID:4984
                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                      2⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:4456
                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                        3⤵
                                                                                                          PID:5976
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                      1⤵
                                                                                                        PID:5828
                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                          2⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          PID:5680
                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                            3⤵
                                                                                                              PID:4660
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                          1⤵
                                                                                                            PID:1016
                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                              2⤵
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              PID:5152
                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                3⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2588
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                            1⤵
                                                                                                              PID:1620
                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                2⤵
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1444
                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                  3⤵
                                                                                                                    PID:6048
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                1⤵
                                                                                                                  PID:2748
                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:6020
                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                      3⤵
                                                                                                                        PID:1752
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                    1⤵
                                                                                                                      PID:1652
                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                        2⤵
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:3196
                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1544
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                      1⤵
                                                                                                                        PID:2160
                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4444
                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                            3⤵
                                                                                                                              PID:1276
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          1⤵
                                                                                                                            PID:3140
                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                              2⤵
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1696
                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:4012
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                              1⤵
                                                                                                                                PID:4900
                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                  2⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  PID:3940
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:448
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:1356
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      2⤵
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3928
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2876
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5156
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:5924
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4968
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:5296
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          2⤵
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          PID:2008
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:2984
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:5532
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:312
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5036
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:3888
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3208
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2960
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:372
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:1692
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4188
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4800
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        2⤵
                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                        PID:4608
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5288
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1100
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:4612
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3448
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4520
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1232
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1936
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1872
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  PID:1108
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3400
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5260
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5596
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3216
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3392
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          PID:1588
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4568
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1020
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1736
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5228
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:6076
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1832
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2152
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5240
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1620
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:320
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2688
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4628
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5200
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4460
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2160
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4132
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3104
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:5312
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4588
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4748
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2524
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3248
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:6064
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1368
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3144
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3776
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3864
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5600
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:2004
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3232
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:732
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5216
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4932
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:5412
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2648
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:956
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinDefender.exe"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3148

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            340KB

                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                            996e057529b5c7f5a5967eb80ecabe32

                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                            1acf03131730d3ad618edde6888e42548195e1ca

                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                            889b75846fe4c693e2fda9740bfff552a8ee27382a6f8b012939e23a7abf334f

                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                            532fdf9bb18df8e43c54924f38221c9fad7cae333ab48ed081b3b2b0be4c0e814d8c153f6ac7914c756026e00dadfb2013277531a160c5f90146150b0f3d0e03

                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                          • memory/436-174-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/856-147-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1068-129-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/1800-151-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/2044-53-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3656-107-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3740-176-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-83-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-9-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-64-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-4-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-8-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-10-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/3884-2-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/4316-79-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/4428-105-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/4700-127-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/5224-59-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/5292-36-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/5416-28-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                          • memory/5868-81-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                            316KB

                                                                                                                                                                                                                                                                            Download