Overview

overview

10

Static

static

3

JaffaCakes...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 22:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe

  • Size

    214KB

  • MD5

    9cdc7633ca968e16df49638c01de1ae4

  • SHA1

    f4d40223d01b216d8fe3d7b7076a0a0e0eace6b3

  • SHA256

    e94215f96e0cb3de6e6e734c1bb9e89b79162704979bbc52b13037957ca083dd

  • SHA512

    b9a51689cf346a38672d91f3a90a98d782c467af6d1c91f37abab97fe910c2926fa8e7634afa3b61b710c3c9a948dc9bd9dd8e1921865f35af2a6fc73f313a3a

  • SSDEEP

    3072:T5q4JJ5oiTxdl5mlJ8VZkF2kCJDbxi9Yfc29Km78aySTMkrl:T5r+IHkCJDti9Yfc29KqhPr

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 24 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1104
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1192
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9cdc7633ca968e16df49638c01de1ae4.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:5000
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • Modifies registry key
        PID:1872
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4680
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1644
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:5176
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:5552
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4240
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5128
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5620
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:952
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5076
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5740
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4508
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5660
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2488
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5808
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4312
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1872
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5688
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4200
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4836
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      C:\Users\Admin\AppData\Roaming\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3740
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
    1⤵
      PID:6112
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        C:\Users\Admin\AppData\Roaming\svchost.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2832
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
      1⤵
        PID:3156
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          C:\Users\Admin\AppData\Roaming\svchost.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
        1⤵
          PID:3904
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            C:\Users\Admin\AppData\Roaming\svchost.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1344
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
          1⤵
            PID:2972
            • C:\Users\Admin\AppData\Roaming\svchost.exe
              C:\Users\Admin\AppData\Roaming\svchost.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1868
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
            1⤵
              PID:3672
              • C:\Users\Admin\AppData\Roaming\svchost.exe
                C:\Users\Admin\AppData\Roaming\svchost.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3688
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
              1⤵
                PID:800
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  C:\Users\Admin\AppData\Roaming\svchost.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1172
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                1⤵
                  PID:656
                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                    C:\Users\Admin\AppData\Roaming\svchost.exe
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4532
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                  1⤵
                    PID:4964
                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                      C:\Users\Admin\AppData\Roaming\svchost.exe
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1928
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                    1⤵
                      PID:5812
                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                        C:\Users\Admin\AppData\Roaming\svchost.exe
                        2⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:5444
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                      1⤵
                        PID:3736
                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                          C:\Users\Admin\AppData\Roaming\svchost.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:5456
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                        1⤵
                          PID:6000
                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            C:\Users\Admin\AppData\Roaming\svchost.exe
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:4412
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                          1⤵
                            PID:5360
                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                              C:\Users\Admin\AppData\Roaming\svchost.exe
                              2⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:2856
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                            1⤵
                              PID:5788
                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                2⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:4992
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                              1⤵
                                PID:3108
                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1400
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                1⤵
                                  PID:5764
                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4776
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                  1⤵
                                    PID:4724
                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4852
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                    1⤵
                                      PID:3712
                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5824
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                      1⤵
                                        PID:2360
                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5676
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                        1⤵
                                          PID:3404
                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:5332
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                          1⤵
                                            PID:3180
                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:4524
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                            1⤵
                                              PID:5548
                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:5240
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                              1⤵
                                                PID:5696
                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6024
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                1⤵
                                                  PID:1784
                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:5468
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                  1⤵
                                                    PID:1176
                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:728
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                    1⤵
                                                      PID:1280
                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5540
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                      1⤵
                                                        PID:2256
                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:3936
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                        1⤵
                                                          PID:3704
                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:5728
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                          1⤵
                                                            PID:3000
                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:364
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                            1⤵
                                                              PID:5268
                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1860
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                              1⤵
                                                                PID:3692
                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2552
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                1⤵
                                                                  PID:3228
                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4992
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                  1⤵
                                                                    PID:2356
                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4944
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                    1⤵
                                                                      PID:4156
                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:5256
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                      1⤵
                                                                        PID:4656
                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4604
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                        1⤵
                                                                          PID:4784
                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:2892
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                          1⤵
                                                                            PID:2968
                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4820
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                            1⤵
                                                                              PID:4828
                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                PID:1576
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                              1⤵
                                                                                PID:3320
                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:4868
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                1⤵
                                                                                  PID:2036
                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:3812
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                  1⤵
                                                                                    PID:2636
                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:6068
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                    1⤵
                                                                                      PID:3176
                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3132
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                      1⤵
                                                                                        PID:3252
                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3828
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                        1⤵
                                                                                          PID:2592
                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:4224
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                          1⤵
                                                                                            PID:4092
                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1484
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                            1⤵
                                                                                              PID:2696
                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:736
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                              1⤵
                                                                                                PID:5464
                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4416
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                1⤵
                                                                                                  PID:4488
                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:872
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                  1⤵
                                                                                                    PID:2472
                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:3492
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                    1⤵
                                                                                                      PID:3208
                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3280
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                      1⤵
                                                                                                        PID:3244
                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5060
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                        1⤵
                                                                                                          PID:5324
                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5456
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                          1⤵
                                                                                                            PID:1864
                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              2⤵
                                                                                                                PID:5588
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                              1⤵
                                                                                                                PID:5812
                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1096
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                1⤵
                                                                                                                  PID:3720
                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4832
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                  1⤵
                                                                                                                    PID:4516
                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4848
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                    1⤵
                                                                                                                      PID:4988
                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        2⤵
                                                                                                                          PID:1192
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                        1⤵
                                                                                                                          PID:4776
                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            2⤵
                                                                                                                              PID:5272
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                            1⤵
                                                                                                                              PID:5764
                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2896
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                              1⤵
                                                                                                                                PID:2832
                                                                                                                                • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4396
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1624
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    2⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4688
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:3852
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1900
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:3660
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        2⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1576
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:5088
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                          2⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5716
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:1788
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            2⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4936
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:3696
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5548
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:6084
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:3224
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:2308
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2920
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3456
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4404
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:6104
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1716
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4456
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1320
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2412
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3492
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:924
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5368

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                    Filesize

                                                                                                                                                                    214KB

                                                                                                                                                                    MD5

                                                                                                                                                                    9cdc7633ca968e16df49638c01de1ae4

                                                                                                                                                                    SHA1

                                                                                                                                                                    f4d40223d01b216d8fe3d7b7076a0a0e0eace6b3

                                                                                                                                                                    SHA256

                                                                                                                                                                    e94215f96e0cb3de6e6e734c1bb9e89b79162704979bbc52b13037957ca083dd

                                                                                                                                                                    SHA512

                                                                                                                                                                    b9a51689cf346a38672d91f3a90a98d782c467af6d1c91f37abab97fe910c2926fa8e7634afa3b61b710c3c9a948dc9bd9dd8e1921865f35af2a6fc73f313a3a

                                                                                                                                                                    Download Submit

                                                                                                                                                                  • memory/952-46-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1064-124-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1172-154-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1344-134-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1644-18-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1868-139-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/1872-94-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2488-80-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/2832-121-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-0-0x00000000009D0000-0x0000000000A46000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-52-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-53-0x000000000043F000-0x000000000045B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    112KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-129-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-1-0x000000000043F000-0x000000000045B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    112KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3652-86-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3688-152-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/3740-108-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4200-96-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4240-37-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4312-81-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4508-67-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/4836-110-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5076-66-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5176-23-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5552-32-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download

                                                                                                                                                                  • memory/5620-51-0x0000000000400000-0x0000000000476000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    472KB

                                                                                                                                                                    Download