Overview

overview

10

Static

static

3

JaffaCakes...d2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2025, 21:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_a1a67979e6c80610fe019b31eb0fd2d2.exe

  • Size

    706KB

  • MD5

    a1a67979e6c80610fe019b31eb0fd2d2

  • SHA1

    486c6f18db6053fe84b9997a85cca5bc5b75d84f

  • SHA256

    95e69fccc7e30d4117391abb63d05f718f8be21937b1b5abf41924690d432688

  • SHA512

    253866fa52e972bb6f7188724603a81455573f740b6a4806fc73b5132f8578d5462107645aa9760cca18088152f5e1afa1d071d3c3888c84d1ec46774ef0c282

  • SSDEEP

    12288:iGu0dzKPTHzRVwMWRL1xjrGH+E75h92PvfTyjbq1sYMuCEgVyTc8FZYU:i2SDDXurGH+E7UPTJ1sYMKA8c

Score
10/10
blackshadesdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 47 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 64 IoCs
    defense_evasiontrojan
  • Suspicious use of SetThreadContext 43 IoCs
  • UPX packed file 49 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1a67979e6c80610fe019b31eb0fd2d2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a1a67979e6c80610fe019b31eb0fd2d2.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5896
    • C:\Users\Admin\AppData\Roaming\msconfig.exe
      "C:\Users\Admin\AppData\Roaming\msconfig.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5792
      • C:\Users\Admin\AppData\Roaming\msconfig.exe
        "C:\Users\Admin\AppData\Roaming\msconfig.exe"
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4672
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:4844
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\msconfig.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\msconfig.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\msconfig.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\msconfig.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4836
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:6104
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:4832
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Roaming\explorer.exe
      C:\Users\Admin\AppData\Roaming\explorer.exe
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      PID:4092
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Roaming\explorer.exe
      C:\Users\Admin\AppData\Roaming\explorer.exe
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Users\Admin\AppData\Roaming\explorer.exe
        C:\Users\Admin\AppData\Roaming\explorer.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5492
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\AppData\Roaming\explorer.exe
      C:\Users\Admin\AppData\Roaming\explorer.exe
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2140
      • C:\Users\Admin\AppData\Roaming\explorer.exe
        C:\Users\Admin\AppData\Roaming\explorer.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2596
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Users\Admin\AppData\Roaming\explorer.exe
      C:\Users\Admin\AppData\Roaming\explorer.exe
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:5152
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
    1⤵
      PID:5800
      • C:\Users\Admin\AppData\Roaming\explorer.exe
        C:\Users\Admin\AppData\Roaming\explorer.exe
        2⤵
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        PID:5244
        • C:\Users\Admin\AppData\Roaming\explorer.exe
          C:\Users\Admin\AppData\Roaming\explorer.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2532
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
      1⤵
        PID:3988
        • C:\Users\Admin\AppData\Roaming\explorer.exe
          C:\Users\Admin\AppData\Roaming\explorer.exe
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          PID:5376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
        1⤵
          PID:3916
          • C:\Users\Admin\AppData\Roaming\explorer.exe
            C:\Users\Admin\AppData\Roaming\explorer.exe
            2⤵
            • Executes dropped EXE
            PID:5744
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
          1⤵
            PID:5640
            • C:\Users\Admin\AppData\Roaming\explorer.exe
              C:\Users\Admin\AppData\Roaming\explorer.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:968
              • C:\Users\Admin\AppData\Roaming\explorer.exe
                C:\Users\Admin\AppData\Roaming\explorer.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2484
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
            1⤵
              PID:5400
              • C:\Users\Admin\AppData\Roaming\explorer.exe
                C:\Users\Admin\AppData\Roaming\explorer.exe
                2⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                PID:2188
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
              1⤵
                PID:4432
                • C:\Users\Admin\AppData\Roaming\explorer.exe
                  C:\Users\Admin\AppData\Roaming\explorer.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  PID:4244
                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                    C:\Users\Admin\AppData\Roaming\explorer.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:5252
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                1⤵
                  PID:2324
                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                    C:\Users\Admin\AppData\Roaming\explorer.exe
                    2⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:3832
                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                      C:\Users\Admin\AppData\Roaming\explorer.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3248
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                  1⤵
                    PID:1864
                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                      C:\Users\Admin\AppData\Roaming\explorer.exe
                      2⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      PID:6056
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                    1⤵
                      PID:6060
                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                        C:\Users\Admin\AppData\Roaming\explorer.exe
                        2⤵
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of SetThreadContext
                        PID:5036
                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                          C:\Users\Admin\AppData\Roaming\explorer.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3452
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                      1⤵
                        PID:1032
                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                          C:\Users\Admin\AppData\Roaming\explorer.exe
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • System Location Discovery: System Language Discovery
                          PID:5452
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                        1⤵
                          PID:4516
                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                            C:\Users\Admin\AppData\Roaming\explorer.exe
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:4860
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                          1⤵
                            PID:4560
                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                              C:\Users\Admin\AppData\Roaming\explorer.exe
                              2⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:4836
                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4700
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                            1⤵
                              PID:4948
                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                2⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:4920
                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:400
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                              1⤵
                                PID:4908
                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:4772
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                1⤵
                                  PID:4704
                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:3380
                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1268
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                  1⤵
                                    PID:1940
                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                      2⤵
                                      • Executes dropped EXE
                                      PID:3732
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                    1⤵
                                      PID:3576
                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • System Location Discovery: System Language Discovery
                                        PID:4424
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                      1⤵
                                        PID:3132
                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          PID:5536
                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5888
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                        1⤵
                                          PID:4240
                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            PID:5280
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                          1⤵
                                            PID:3816
                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:564
                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3744
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                            1⤵
                                              PID:5296
                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • System Location Discovery: System Language Discovery
                                                PID:1372
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                              1⤵
                                                PID:3080
                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5452
                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5040
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                1⤵
                                                  PID:5312
                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4856
                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1972
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                  1⤵
                                                    PID:4496
                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4760
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                    1⤵
                                                      PID:4852
                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4552
                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4792
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                      1⤵
                                                        PID:4740
                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4796
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                        1⤵
                                                          PID:4968
                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:4372
                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:6016
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                          1⤵
                                                            PID:4532
                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              PID:4680
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                            1⤵
                                                              PID:3352
                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:4356
                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5844
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                              1⤵
                                                                PID:5948
                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:4500
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                1⤵
                                                                  PID:2560
                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    PID:744
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                  1⤵
                                                                    PID:4132
                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of SetThreadContext
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2800
                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3720
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                    1⤵
                                                                      PID:1136
                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5736
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                      1⤵
                                                                        PID:1296
                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:4088
                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4712
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                        1⤵
                                                                          PID:5628
                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5616
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                          1⤵
                                                                            PID:2632
                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:5412
                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5888
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                            1⤵
                                                                              PID:4160
                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of SetThreadContext
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:888
                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3348
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                              1⤵
                                                                                PID:4300
                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  PID:1772
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                1⤵
                                                                                  PID:5968
                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                    2⤵
                                                                                      PID:1020
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                    1⤵
                                                                                      PID:2280
                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                        2⤵
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3880
                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                          3⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4492
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                      1⤵
                                                                                        PID:5840
                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                          2⤵
                                                                                          • Checks whether UAC is enabled
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4840
                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                            3⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4832
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                        1⤵
                                                                                          PID:3092
                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                            2⤵
                                                                                            • Checks whether UAC is enabled
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4860
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                          1⤵
                                                                                            PID:4524
                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                              2⤵
                                                                                              • Checks whether UAC is enabled
                                                                                              PID:4556
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                            1⤵
                                                                                              PID:4844
                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                2⤵
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5316
                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1444
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                              1⤵
                                                                                                PID:3372
                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                  2⤵
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:6104
                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                    3⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1628
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                1⤵
                                                                                                  PID:2796
                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                    2⤵
                                                                                                    • Checks whether UAC is enabled
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5192
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                  1⤵
                                                                                                    PID:5608
                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                      2⤵
                                                                                                      • Checks whether UAC is enabled
                                                                                                      PID:6084
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3544
                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                        2⤵
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        PID:1600
                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                          3⤵
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1728
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                      1⤵
                                                                                                        PID:6128
                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                          2⤵
                                                                                                          • Suspicious use of SetThreadContext
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3352
                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                            3⤵
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4592
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                        1⤵
                                                                                                          PID:6024
                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                            2⤵
                                                                                                            • Checks whether UAC is enabled
                                                                                                            PID:2540
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4880
                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                              2⤵
                                                                                                              • Checks whether UAC is enabled
                                                                                                              PID:2924
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3792
                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                2⤵
                                                                                                                • Checks whether UAC is enabled
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:3988
                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4448
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4080
                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  2⤵
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  PID:5736
                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    3⤵
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:1048
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:1944
                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    2⤵
                                                                                                                    • Checks whether UAC is enabled
                                                                                                                    PID:5676
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:5568
                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                      2⤵
                                                                                                                      • Checks whether UAC is enabled
                                                                                                                      PID:5072
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1296
                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                        2⤵
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:5628
                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                          3⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5980
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4684
                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                          2⤵
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1712
                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:5084
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:5624
                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                            2⤵
                                                                                                                              PID:5412
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:5056
                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                2⤵
                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                PID:1772
                                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:1304
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1396
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:336
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:6020
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        2⤵
                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:224
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4480
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:3260
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                          2⤵
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1480
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:4340
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            PID:2324
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              3⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5012
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:5276
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              2⤵
                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                              PID:4324
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:5300
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:1672
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4428
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5564
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                    3⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:5172
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4484
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4836
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:520
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4204
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4320
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5044
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          2⤵
                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:6104
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3204
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4752
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                              PID:4532
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1764
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3228
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5608
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1940
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1532
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3120
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                      PID:1592
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1132
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        PID:1152
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5404
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4936
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3996
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5688
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5144
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3200
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5740
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5652
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4364
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    PID:1620
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2468
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5176
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:2216
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3844
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4348
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3220

                                                                                                                                                                                    Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\data.dat
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      32B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      81b20dcb50d87a6359dea0f4a5692427

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      bd6b4f095a7911456bf0a8a049eebd2b8516369e

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      482a2f6490f7cb7c9bff98fb4fbb08a04273defa36f0b6ba70ac1750a8217e1b

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      7b7241843e47f3a0beb4080abe44ae85a95da4da03aade6bcd004c676cfbfcb67ff59ee13f97b10a0f53209c8984f5d15f3931391454aca82fe462c67ea1f69d

                                                                                                                                                                                      Download Submit

                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\msconfig.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      560KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      d400efea7d7c1a27b934acb3ac717c8a

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      cb81efe1850741c758c4d9308c626b894c40f2f5

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      5c28c1badb360f8f7f4685a9aa46c7253729c1eabb93394f88629cab4e2d3ead

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      d549d240d3295c4001913e3dd284b83a6b073e8829c9c31e946ab789c5780f49d8ee3800c7ad40e450152108899c1584d368a19e6e4f3131937f281fe492e811

                                                                                                                                                                                      Download Submit

                                                                                                                                                                                    • memory/400-138-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1048-375-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1268-154-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1304-405-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1444-326-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1532-469-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1628-335-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1728-344-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1972-205-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/2468-499-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/2484-84-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/2532-70-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/2596-57-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3204-457-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3248-106-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3348-296-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3452-120-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3720-260-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3744-178-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/3844-508-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4320-448-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4448-366-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-59-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-32-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-108-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-142-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-18-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-22-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-65-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4460-25-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4480-417-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4492-305-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4592-357-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4712-272-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4792-220-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/4832-314-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5012-426-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5040-193-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5084-396-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5172-439-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5252-95-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5404-478-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5492-46-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5688-487-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5844-244-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5888-165-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5888-284-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-0-0x0000000075052000-0x0000000075053000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      4KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-38-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-17-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-16-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-4-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-3-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-24-0x0000000075052000-0x0000000075053000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      4KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-2-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5896-1-0x0000000075050000-0x0000000075601000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.7MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/5980-387-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/6016-232-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      464KB

                                                                                                                                                                                      Download