Overview

overview

10

Static

static

3

JaffaCakes...35.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2025, 20:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_a168a3e87ad513360084f51576a80435.exe

  • Size

    189KB

  • MD5

    a168a3e87ad513360084f51576a80435

  • SHA1

    8c1ab58e960ec7bbac9d1994cc615e81ee037393

  • SHA256

    f9ebbf31433fe096b85efd20e808bf811fd0623406ad528246a4ec24d2380ca4

  • SHA512

    b3acc494ca323092c0235ca444e71097845294a19512651bc9de45a17c7fdb14ad771718606d96ded83f3823fb9adc912945cb8d13d6a6d4d5bd924ca58531ac

  • SSDEEP

    3072:a6JnKicCmrF7TLZYXSLS/BaKqdaPiRRgI/ZDsMRaesdy9/VkGabUf/b1p5A7:aEPcVF7TtqPEaPiRSlMwesd6kvbe/Jnk

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 64 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 64 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 64 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 64 IoCs
  • Windows security modification 2 TTPs 64 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 64 IoCs
    defense_evasiontrojan
  • Suspicious use of SetThreadContext 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe"
    1⤵
    • Windows security modification
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5776
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
          PID:2424
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            4⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:636
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe:*:Enabled:Windows Messanger" /f
          3⤵
            PID:2232
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a168a3e87ad513360084f51576a80435.exe:*:Enabled:Windows Messanger" /f
              4⤵
              • Modifies firewall policy service
              • Modifies registry key
              PID:3968
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1940
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              4⤵
              • Modifies firewall policy service
              • Modifies registry key
              PID:3432
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WinDefender.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinDefender.exe:*:Enabled:Windows Messanger" /f
            3⤵
              PID:3488
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WinDefender.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinDefender.exe:*:Enabled:Windows Messanger" /f
                4⤵
                • Modifies firewall policy service
                • Modifies registry key
                PID:5988
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3344
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            C:\Users\Admin\AppData\Roaming\WinDefender.exe
            2⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4624
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4948
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            C:\Users\Admin\AppData\Roaming\WinDefender.exe
            2⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4668
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2472
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:6076
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            C:\Users\Admin\AppData\Roaming\WinDefender.exe
            2⤵
            • UAC bypass
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3368
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3864
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3384
          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
            C:\Users\Admin\AppData\Roaming\WinDefender.exe
            2⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:6096
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2980
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
          1⤵
            PID:5488
            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
              C:\Users\Admin\AppData\Roaming\WinDefender.exe
              2⤵
              • Windows security bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:3820
              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2696
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
            1⤵
              PID:1312
              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                2⤵
                • UAC bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1072
                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2740
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
              1⤵
                PID:1768
                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  2⤵
                  • UAC bypass
                  • Windows security bypass
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:1780
                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1748
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                1⤵
                  PID:2888
                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    2⤵
                    • UAC bypass
                    • Executes dropped EXE
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:5084
                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:5228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                  1⤵
                    PID:5956
                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      2⤵
                      • UAC bypass
                      • Windows security bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:3460
                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2216
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                    1⤵
                      PID:632
                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        2⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:5124
                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:752
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                      1⤵
                        PID:4332
                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          2⤵
                          • UAC bypass
                          • Windows security bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:5432
                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2124
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                        1⤵
                          PID:5928
                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            2⤵
                            • UAC bypass
                            • Windows security bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:5092
                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3568
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                          1⤵
                            PID:4716
                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              2⤵
                              • UAC bypass
                              • Windows security bypass
                              • Executes dropped EXE
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:4624
                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3344
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                            1⤵
                              PID:3896
                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                2⤵
                                • UAC bypass
                                • Windows security bypass
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetWindowsHookEx
                                PID:4656
                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4864
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                              1⤵
                                PID:4676
                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  2⤵
                                  • UAC bypass
                                  • Windows security bypass
                                  • Executes dropped EXE
                                  • Windows security modification
                                  • Checks whether UAC is enabled
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5364
                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2400
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                1⤵
                                  PID:4872
                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    2⤵
                                    • UAC bypass
                                    • Executes dropped EXE
                                    • Windows security modification
                                    • Checks whether UAC is enabled
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1568
                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4724
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                  1⤵
                                    PID:6096
                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      2⤵
                                      • Windows security bypass
                                      • Executes dropped EXE
                                      • Windows security modification
                                      • Checks whether UAC is enabled
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:2724
                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1068
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                    1⤵
                                      PID:5804
                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        2⤵
                                        • UAC bypass
                                        • Windows security bypass
                                        • Executes dropped EXE
                                        • Windows security modification
                                        • Checks whether UAC is enabled
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:968
                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5520
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                      1⤵
                                        PID:1968
                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          2⤵
                                          • UAC bypass
                                          • Executes dropped EXE
                                          • Windows security modification
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:5860
                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5320
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                        1⤵
                                          PID:4376
                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            2⤵
                                            • UAC bypass
                                            • Executes dropped EXE
                                            • Windows security modification
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:636
                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:408
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                          1⤵
                                            PID:3880
                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              2⤵
                                              • UAC bypass
                                              • Windows security bypass
                                              • Executes dropped EXE
                                              • Windows security modification
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5492
                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                3⤵
                                                • Executes dropped EXE
                                                PID:4664
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                            1⤵
                                              PID:2316
                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                2⤵
                                                • Windows security bypass
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:3708
                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2156
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                              1⤵
                                                PID:4728
                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  2⤵
                                                  • UAC bypass
                                                  • Windows security bypass
                                                  • Executes dropped EXE
                                                  • Windows security modification
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:4652
                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1564
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                1⤵
                                                  PID:1120
                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    2⤵
                                                    • UAC bypass
                                                    • Windows security bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:4796
                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:4732
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                  1⤵
                                                    PID:1004
                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      2⤵
                                                      • UAC bypass
                                                      • Windows security bypass
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:2856
                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:3604
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                    1⤵
                                                      PID:4368
                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        2⤵
                                                        • UAC bypass
                                                        • Windows security bypass
                                                        • Executes dropped EXE
                                                        • Windows security modification
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:1216
                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5328
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                      1⤵
                                                        PID:1148
                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          2⤵
                                                          • Windows security bypass
                                                          • Executes dropped EXE
                                                          • Windows security modification
                                                          • Suspicious use of SetThreadContext
                                                          • System Location Discovery: System Language Discovery
                                                          • System policy modification
                                                          PID:852
                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6024
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                        1⤵
                                                          PID:1764
                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            2⤵
                                                            • UAC bypass
                                                            • Executes dropped EXE
                                                            • Windows security modification
                                                            • Checks whether UAC is enabled
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • System policy modification
                                                            PID:4720
                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4612
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                          1⤵
                                                            PID:1556
                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              2⤵
                                                              • UAC bypass
                                                              • Windows security bypass
                                                              • Executes dropped EXE
                                                              • Windows security modification
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of SetThreadContext
                                                              • System policy modification
                                                              PID:1324
                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1072
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                            1⤵
                                                              PID:4892
                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                2⤵
                                                                • UAC bypass
                                                                • Windows security bypass
                                                                • Executes dropped EXE
                                                                • Windows security modification
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of SetThreadContext
                                                                • System policy modification
                                                                PID:2116
                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:668
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                              1⤵
                                                                PID:932
                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Windows security modification
                                                                  • Suspicious use of SetThreadContext
                                                                  • System policy modification
                                                                  PID:4800
                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:5688
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                1⤵
                                                                  PID:3820
                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    • System policy modification
                                                                    PID:864
                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      PID:5752
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                  1⤵
                                                                    PID:3436
                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      2⤵
                                                                      • UAC bypass
                                                                      • Windows security bypass
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:5368
                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                        3⤵
                                                                          PID:4064
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                      1⤵
                                                                        PID:1540
                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                          2⤵
                                                                          • UAC bypass
                                                                          • Windows security bypass
                                                                          • Windows security modification
                                                                          • Suspicious use of SetThreadContext
                                                                          • System policy modification
                                                                          PID:5956
                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3708
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                        1⤵
                                                                          PID:1732
                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            2⤵
                                                                            • UAC bypass
                                                                            • Windows security bypass
                                                                            • Checks whether UAC is enabled
                                                                            • Suspicious use of SetThreadContext
                                                                            • System policy modification
                                                                            PID:448
                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                              3⤵
                                                                                PID:4556
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                            1⤵
                                                                              PID:4088
                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                2⤵
                                                                                • UAC bypass
                                                                                • Windows security bypass
                                                                                • Windows security modification
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of SetThreadContext
                                                                                • System policy modification
                                                                                PID:700
                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                  3⤵
                                                                                    PID:5212
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                1⤵
                                                                                  PID:4284
                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                    2⤵
                                                                                    • UAC bypass
                                                                                    • Windows security bypass
                                                                                    • Windows security modification
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • System policy modification
                                                                                    PID:4624
                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      3⤵
                                                                                        PID:4868
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                    1⤵
                                                                                      PID:1992
                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                        2⤵
                                                                                        • UAC bypass
                                                                                        • Windows security bypass
                                                                                        • Windows security modification
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System policy modification
                                                                                        PID:4760
                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5132
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                      1⤵
                                                                                        PID:4668
                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          2⤵
                                                                                          • UAC bypass
                                                                                          • Checks whether UAC is enabled
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:4880
                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            3⤵
                                                                                              PID:388
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                          1⤵
                                                                                            PID:5420
                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                              2⤵
                                                                                              • Windows security modification
                                                                                              • Checks whether UAC is enabled
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • System policy modification
                                                                                              PID:4508
                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5424
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                            1⤵
                                                                                              PID:5328
                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                2⤵
                                                                                                • Windows security modification
                                                                                                • Checks whether UAC is enabled
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System policy modification
                                                                                                PID:3940
                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                  3⤵
                                                                                                    PID:884
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                1⤵
                                                                                                  PID:5148
                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                    2⤵
                                                                                                    • UAC bypass
                                                                                                    • Windows security bypass
                                                                                                    • Windows security modification
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • System policy modification
                                                                                                    PID:724
                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                      3⤵
                                                                                                        PID:1496
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                    1⤵
                                                                                                      PID:3064
                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                        2⤵
                                                                                                        • Windows security bypass
                                                                                                        • Windows security modification
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • System policy modification
                                                                                                        PID:5880
                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                          3⤵
                                                                                                            PID:3056
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                        1⤵
                                                                                                          PID:1184
                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                            2⤵
                                                                                                            • UAC bypass
                                                                                                            • Windows security bypass
                                                                                                            • Windows security modification
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            PID:5624
                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                              3⤵
                                                                                                                PID:2208
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                            1⤵
                                                                                                              PID:2544
                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                2⤵
                                                                                                                • UAC bypass
                                                                                                                • Windows security bypass
                                                                                                                • Windows security modification
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • System policy modification
                                                                                                                PID:4876
                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  3⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2752
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                              1⤵
                                                                                                                PID:4564
                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  2⤵
                                                                                                                  • UAC bypass
                                                                                                                  • Windows security bypass
                                                                                                                  • Windows security modification
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • System policy modification
                                                                                                                  PID:1652
                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                    3⤵
                                                                                                                      PID:3868
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                  1⤵
                                                                                                                    PID:4408
                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                      2⤵
                                                                                                                      • Windows security bypass
                                                                                                                      • Windows security modification
                                                                                                                      • System policy modification
                                                                                                                      PID:224
                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                        3⤵
                                                                                                                          PID:3172
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                      1⤵
                                                                                                                        PID:1940
                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                          2⤵
                                                                                                                          • UAC bypass
                                                                                                                          • Windows security bypass
                                                                                                                          • Windows security modification
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • System policy modification
                                                                                                                          PID:4328
                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:548
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                        1⤵
                                                                                                                          PID:1532
                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            2⤵
                                                                                                                            • Windows security modification
                                                                                                                            • Checks whether UAC is enabled
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4960
                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                              3⤵
                                                                                                                                PID:3268
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                            1⤵
                                                                                                                              PID:1312
                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                2⤵
                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                • System policy modification
                                                                                                                                PID:624
                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:1428
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4900
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                    2⤵
                                                                                                                                    • Windows security modification
                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • System policy modification
                                                                                                                                    PID:4512
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:1672
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5872
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                        2⤵
                                                                                                                                        • UAC bypass
                                                                                                                                        • Windows security bypass
                                                                                                                                        • Windows security modification
                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • System policy modification
                                                                                                                                        PID:452
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2236
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3276
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          2⤵
                                                                                                                                          • Windows security bypass
                                                                                                                                          • Windows security modification
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • System policy modification
                                                                                                                                          PID:4824
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:3484
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:4728
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              2⤵
                                                                                                                                              • UAC bypass
                                                                                                                                              • Windows security bypass
                                                                                                                                              • Windows security modification
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              • System policy modification
                                                                                                                                              PID:3744
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                3⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4776
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:4832
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                2⤵
                                                                                                                                                • UAC bypass
                                                                                                                                                • Windows security bypass
                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • System policy modification
                                                                                                                                                PID:2120
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  3⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4380
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:5284
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • UAC bypass
                                                                                                                                                  • Windows security bypass
                                                                                                                                                  • Windows security modification
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:532
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4836
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1956
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Windows security bypass
                                                                                                                                                      • Windows security modification
                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:1420
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4720
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3452
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        2⤵
                                                                                                                                                        • UAC bypass
                                                                                                                                                        • Windows security bypass
                                                                                                                                                        • Windows security modification
                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:3368
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5172
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2412
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • UAC bypass
                                                                                                                                                            • Windows security modification
                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • System policy modification
                                                                                                                                                            PID:1384
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1460
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4872
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:1592
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4376
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1764
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                    • UAC bypass
                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                    • Windows security modification
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:1556
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5472
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3064
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                        • UAC bypass
                                                                                                                                                                        • Windows security modification
                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • System policy modification
                                                                                                                                                                        PID:1856
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1716
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:636
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                          • UAC bypass
                                                                                                                                                                          • Windows security bypass
                                                                                                                                                                          • Windows security modification
                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          PID:5200
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5232
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5896
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Windows security bypass
                                                                                                                                                                              • Windows security modification
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:5488
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5756
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4400
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:1016
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2612
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3128
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                                    • Windows security modification
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:1612
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2768
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4472
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:2008
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:448
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2288
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                            • Windows security bypass
                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:660
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1540
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5784
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                                • Windows security modification
                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3892
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                    • Windows security modification
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:5356
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                      • Windows security modification
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                      PID:5612
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4884
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4616
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:828
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3092
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Windows security bypass
                                                                                                                                                                                                          • Windows security modification
                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                          PID:4508
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1320
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                              • Windows security bypass
                                                                                                                                                                                                              • Windows security modification
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2756
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4676
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                    PID:2616
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3968
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1892
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1544
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Windows security bypass
                                                                                                                                                                                                                            • Windows security modification
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • UAC bypass
                                                                                                                                                                                                                                • Windows security bypass
                                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                    • Windows security bypass
                                                                                                                                                                                                                                    • Windows security modification
                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1856
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                        • Windows security bypass
                                                                                                                                                                                                                                        • Windows security modification
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Windows security bypass
                                                                                                                                                                                                                                            • Windows security modification
                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                              • Windows security modification
                                                                                                                                                                                                                                              PID:5604
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4596
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:1484
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                  • Windows security bypass
                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                  PID:5348
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:932
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:2008
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • UAC bypass
                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                      PID:624
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:448
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                          • Windows security bypass
                                                                                                                                                                                                                                                          • Windows security modification
                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:6008
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1844

                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                        Active Setup

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1547.014

                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1548

                                                                                                                                                                                                                                                        Bypass User Account Control

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1548.002

                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                        T1562.001

                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                        9
                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinDefender.exe
                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          189KB

                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                          a168a3e87ad513360084f51576a80435

                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                          8c1ab58e960ec7bbac9d1994cc615e81ee037393

                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                          f9ebbf31433fe096b85efd20e808bf811fd0623406ad528246a4ec24d2380ca4

                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                          b3acc494ca323092c0235ca444e71097845294a19512651bc9de45a17c7fdb14ad771718606d96ded83f3823fb9adc912945cb8d13d6a6d4d5bd924ca58531ac

                                                                                                                                                                                                                                                          Download Submit

                                                                                                                                                                                                                                                        • memory/376-885-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/388-537-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/408-285-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/448-1060-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/448-860-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/448-1073-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-2-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-7-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-5-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-72-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-43-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/508-6-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/548-628-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/668-418-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/752-150-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/828-910-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/884-565-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/932-1047-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1068-256-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1072-421-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1320-930-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1428-651-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1428-639-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1460-769-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1496-562-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1540-863-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1564-337-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1672-676-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1704-1000-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1716-791-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1748-124-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1844-1070-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1856-1003-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/1892-981-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2116-964-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2116-978-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2124-176-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2156-311-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2208-584-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2216-153-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2236-673-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2400-230-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2472-41-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2612-838-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2696-96-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2740-100-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2752-606-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2756-933-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2768-841-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/2980-67-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3056-587-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3172-631-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3268-654-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3344-207-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3484-699-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3568-179-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3604-369-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3708-467-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3740-1028-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3740-1016-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3864-65-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3868-609-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/3968-958-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4064-470-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4376-772-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4380-724-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4556-489-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4596-1050-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4612-395-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4664-314-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4720-747-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4724-233-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4732-340-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4776-702-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4836-721-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4864-204-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4868-515-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4884-911-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4900-882-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/4948-39-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5012-957-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5132-518-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5172-744-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5172-735-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5212-493-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5228-127-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5232-813-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5320-288-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5328-366-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5424-540-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5472-794-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5488-1025-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5520-259-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5688-445-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5752-448-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/5756-816-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                        • memory/6024-392-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                          Download